Splunk Search

convert date to readable format

katesplunk
Explorer

Experts,
Time of the log is appended in my source file name ... I want it to be converted into a human readable format and i prefer assigning the same to a field . lets say new_time.. Hope u can help me...
Sample file name
...... 20130124 ......... file.txt
...... 20121229.......... file.txt
Thanks
Katrine

Tags (2)
0 Karma

yannK
Splunk Employee
Splunk Employee

first, extract the date from the source.

source=*mysource* | rex field=source "(?<_date_>\d{8})" | table _date_

see http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

second convert the date using your format of choice .
mysearch | convert TIMEFORMAT="%Y-%m-%d" ctime(_date_) AS date

see http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Convert

smolcj
Builder

have the same query, but i dont want it to be in readable format as i am using this time for sorting my field entries..
How to convert the date in the above format to epoch time?
201303140216
yyyymmddHHMM
here hour and minute is in 12 hours clock, so the time may be 02:16PM
tried converting it using
time=strptime(mytime,"%Y%m%d%I%M")
not seems to be working properly...
please help

0 Karma

Drainy
Champion

What did you try exactly?

katesplunk
Explorer

date is in the format yyyymmdd so output should be 24-01-2013.. but result obtained is something else.. tried changing time date variables

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...