Splunk Search

How to convert a number into a Date?

mattheuslima
Explorer

Hello, Folks. 

I have a field that represents a date but in this format (YY/MM/DD).

For example:  on 07/23/20 the field value will be 200723. 

I need to transform this value into a date (DD/MM/YY). 

I tried to use:

| eval MyDateEpoch=strptime(MyDate,"%Y%m%d")

but doesn't work. 

Can you help me ?

Labels (1)
Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
| makeresults
| eval MyDate="200723"
| rex field=MyDate mode=sed "s/(\d\d)(\d\d)(\d\d)/\3\/\2\/\1/"

If MyDate is text, rex is useful.

View solution in original post

to4kawa
Ultra Champion
| makeresults
| eval MyDate="200723"
| rex field=MyDate mode=sed "s/(\d\d)(\d\d)(\d\d)/\3\/\2\/\1/"

If MyDate is text, rex is useful.

mattheuslima
Explorer

It work!!

Thank you !!!!

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

you should try “%y%m%d” as format string. %y is 99 and %Y is 9999.

r. Ismo

0 Karma

mattheuslima
Explorer

Hi, @isoutamo . Thanks for answer!

Unfortunately it doesn't work. 

I got this as an answer   "Error in 'eval' command: The expression is malformed. Expected AND."

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Please try this:

 

index=_audit
| head 1
| eval MyDate="200723"
| eval MyDateEpoch=strptime(MyDate,"%y%m%d")
| eval NewDate=strftime(MyDateEpoch, "%d/%m/%y")
| table MyDate MyDateEpoch NewDate

 

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...