Solved: Re: Trying to change date - Splunk Community

Splunk Search

index=_internal | eval Mahesh=replace(date, "^(\d{1,2})/(\d{1,2})/", "\2/\1/")

My date 03-16-2018 I need 16-03-2018

1 Solution

Solution

I notice that your sample dates have dashes, while your attempted regex uses slashes. How about this:

index=_internal
| eval Mahesh=replace(date, "^(\d{1,2})-(\d{1,2})-", "\2/-1-")

View solution in original post

Thanks It did work but small correction, below correct syntex.

index=_internal | eval Mahesh=replace(Date, "^(\d{1,2})-(\d{1,2})-"," \2-\1-")

Solution

I notice that your sample dates have dashes, while your attempted regex uses slashes. How about this:

index=_internal
| eval Mahesh=replace(date, "^(\d{1,2})-(\d{1,2})-", "\2/-1-")

Get Updates on the Splunk Community!

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path

When you run Edge Processor in hybrid mode, alongside a Splunk heavy forwarder on the same host, two questions ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Request for Professional Development: Attending .conf26

Winning Over the Boss: Your Pass to .conf26 conf26 is going to be here before you know it. If don't already ...