I have a python program that's generating logs with the following format START_DATE=08-AUG-2017
the problem is Splunk is interpreting the field value as a string and not a number, thus not a date. I would like to create a permanent field extraction to query the field as a date. How do I do that?
At extract time, that is on this page - https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Data/Configuretimestamprecognition
The entries would look something like this...
[your source type or source or whatever]
TIME_PREFIX = START_DATE=
TIME_FORMAT = %d-%b-%Y
TZ = whatever time zone your data is coming from
And if you also want the value stored as an epoch date in the START_DATE field as well, you could have a transform to do that... discussed here - http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Data/Configureindex-timefieldextraction
That might look something like this...
REGEX = .
FORMAT = START_DATE::$1
DEST_KEY = START_DATE
SOURCE_KEY = _time
This documentation speaks to the convert command:
Example: index="indexname" sourcetype="Sourcetype" Search condition | convert auto(Date) | stats count by Date
If that does not help look at the strptime() function:
Example: index="indexname" sourcetype="Sourcetype" Search condition | eval date_time = strptime(Date, "%H:%M") | stats count by date_time
IF the issue your facing is with rex, look at the second link abo e for pattern options. Before you get into testing the strptime, you should confirm that your rex works.