How to transform a string (i.e. 11-MAY-2017) to a date field?

[AJNZAZ]

I have two fields START and END that are tagged as strings. The two fields always carry a value in the format dd-[3-letter MONTH-yyyy. As an example:

START=07-SEP-2017
END=11-NOV-2045

I have gone through and applied solutions provided in previous posts to no avail. I have tried using regex or eval and strptime commands unsuccessfully while attempting to convert the date format 14-JUN-2017 to a date field. my most recent update was to use Index=* sourcetype=* | eval -START=strptime(START, %d-%b-%Y). Has anyone come across this 'specific' format and issue before?

[gcusello]

Hi AJNZAZ,
could you detail your problem?
I checked strptime with your format and it runs, you can use these fields in epochtime for calculations (e.g. difference):

index=_internal 
| head 1 
| eval START="07-SEP-2017", END="11-NOV-2045", START=strptime(START,"%d-%b-%Y"), END=strptime(END,"%d-%b-%Y"), END=strptime(END,"%d-%b-%Y"), DIFF=tostring(END-START,"duration") 
| table START END DIFF

Result is

START   END DIFF
1504735200.000000   2393967600.000000   10292+01:00:00.000000

Bye.
Giuseppe

[AJNZAZ · Accepted solution]

I think I figured it out. This is the syntax I used:

index=NAME sourcetype=NAME | eval START_TIME=strftime(strptime(START, "%d-%b-%Y"), "%m/%d/%y") | | eval END_TIME=strftime(strptime(END, "%d-%b-%Y"), "%m/%d/%y")

[somesoni2]

There may be a syntax issue with the way you used strptime, but can't say for sure as you didn't format the query portion using code formatter (101010 button on top of the editor OR Ctrl+K after selecting text). Try like this

index=yourIndex sourcetype=yourSourcetype | eval START=strptime(START,"%d-%b-%Y")  | eval END=strptime(END,"%d-%b-%Y") 

[AJNZAZ]

Just to add to this....I want the value to be numeric so I can sort it.