I have a time in the following format: 2015-08-11 16:31:25.973 in a field called "Last Modified On". The data comes from a log with several columns containing date time information.
What I'd like is to get a field at search-time that has just the date from the "Last Modified On" field, so I can group other fields by that date at search-time.
Here is my search:
host=* | eval test=strptime('Last Modified On',"%Y%m%d") | table test "Last Modified On"
The output is a table with blanks for all the test field values, and the date time in the Last Modified On field.
I have read other questions, but can't seem to find a similar example where strptime returns a blank for a string date. Is there a way to confirm that "Last Modified On" contains string data?
I think you need to put the dashes in your format string, since they're in your last modified on field
eval test=strptime('Last Modified On',"%Y-%m-%d")
View solution in original post
Awesome. The answer was in epoch time but I was able to convert it with strftime.
LastModDate=strftime(strptime('Last Modified On',"%Y-%m-%d"),"%m %d %Y")