Splunk Search

How to extract just the date from a timestamp converted from epoch time?

Path Finder

I have a conversion set up to change the epoch time | convert ctime(_time) as date time. I would like to keep just the date and ditch the time function.

The field looks like this: 10/20/2015 06:30:15

Thank you for any help

1 Solution

Community Manager
Community Manager

Hi @ECovell

You could use the timeformat argument for convert to specify the format you want right away.

|convert timeformat="%m/%d/%Y" ctime(_time) AS date

Or you could use the eval strftime function instead and specify the format.

|eval date=strftime(_time, "%m/%d/%Y")

View solution in original post

Community Manager
Community Manager

Hi @ECovell

You could use the timeformat argument for convert to specify the format you want right away.

|convert timeformat="%m/%d/%Y" ctime(_time) AS date

Or you could use the eval strftime function instead and specify the format.

|eval date=strftime(_time, "%m/%d/%Y")

View solution in original post

Path Finder

Thank you so very much!!

0 Karma

Community Manager
Community Manager

You're very welcome 🙂

0 Karma

New Member

Hi @ppablo_splunk,

Can we use the above in alerts as well? For example:- $job.earliestTime$ gives me "2018-04-04T00:00:00.000+04:00" wheras I want only "2018-04-04".

0 Karma