How to limit the character length of the date field?

[splunknewby]

How do I limit the characters of a date field to be a certain length?

I.e my date field looks as follows: 2012-01-10T06:12:18Z

I want to limit it to just the date 2012-01-10

[MichaelPriest · Accepted solution]

Have a look at strptime:

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Commontimeformatvariables