Splunk Search

convert string date(without seprater) to readable date format - 20180112 to 12/01/2018

goyals05
Explorer

Hi,

I am using data-models. In raw data I am getting date as YYYYMMDD, I want to convert it in DD/MM/YYYY.

Is there a simple way to convert this as there is no separator ?

Otherwise I have to separate them in 3 different fields and use it.

 ^(?<year>\d\d\d\d)(?<month>\d\d)(?<day>\d\d)

Example : 20180112 to 12/01/2018
Thanks

0 Karma
1 Solution

mayurr98
Super Champion

Try this run anywhere search

| makeresults 
| eval date="20180112 20180130 20180131 20181212 20181231" 
| makemv date 
| mvexpand date 
| eval date=strftime(strptime(date,"%Y%m%d"),"%d/%m/%Y")

In your environment you should write,

<your_base_Search>
| eval date=strftime(strptime(date,"%Y%m%d"),"%d/%m/%Y")

The inner date is the field which have YYYYMMDD format.
let me know if this helps!

View solution in original post

mayurr98
Super Champion

Try this run anywhere search

| makeresults 
| eval date="20180112 20180130 20180131 20181212 20181231" 
| makemv date 
| mvexpand date 
| eval date=strftime(strptime(date,"%Y%m%d"),"%d/%m/%Y")

In your environment you should write,

<your_base_Search>
| eval date=strftime(strptime(date,"%Y%m%d"),"%d/%m/%Y")

The inner date is the field which have YYYYMMDD format.
let me know if this helps!

493669
Super Champion

Try this anywhere search:

| makeresults
| eval Time="20180112"
| eval time=strftime(strptime(Time,"%Y%m%d"),"%d/%m/%Y")

You can create eval field expression in data model using | eval time=strftime(strptime(Time,"%Y%m%d"),"%d/%m/%Y")

mayurr98
Super Champion

this will not work if you have Time="20180125" as the format is DD/MM/YYYY and not MM/DD/YYYY.

0 Karma

493669
Super Champion

Thanks for correction! ☺

0 Karma
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...