Splunk Search

How to convert a number into a Date?

Explorer

Hello, Folks. 

I have a field that represents a date but in this format (YY/MM/DD).

For example:  on 07/23/20 the field value will be 200723. 

I need to transform this value into a date (DD/MM/YY). 

I tried to use:

| eval MyDateEpoch=strptime(MyDate,"%Y%m%d")

but doesn't work. 

Can you help me ?

Labels (1)
Tags (1)
0 Karma
1 Solution

Ultra Champion
| makeresults
| eval MyDate="200723"
| rex field=MyDate mode=sed "s/(\d\d)(\d\d)(\d\d)/\3\/\2\/\1/"

If MyDate is text, rex is useful.

View solution in original post

Ultra Champion
| makeresults
| eval MyDate="200723"
| rex field=MyDate mode=sed "s/(\d\d)(\d\d)(\d\d)/\3\/\2\/\1/"

If MyDate is text, rex is useful.

View solution in original post

Explorer

It work!!

Thank you !!!!

0 Karma

Champion

Hi

you should try “%y%m%d” as format string. %y is 99 and %Y is 9999.

r. Ismo

0 Karma

Explorer

Hi, @soutamo . Thanks for answer!

Unfortunately it doesn't work. 

I got this as an answer   "Error in 'eval' command: The expression is malformed. Expected AND."

0 Karma

Champion

Please try this:

 

index=_audit
| head 1
| eval MyDate="200723"
| eval MyDateEpoch=strptime(MyDate,"%y%m%d")
| eval NewDate=strftime(MyDateEpoch, "%d/%m/%y")
| table MyDate MyDateEpoch NewDate

 

0 Karma