Splunk Search

convert string date(without seprater) to readable date format - 20180112 to 12/01/2018

goyals05
Explorer

Hi,

I am using data-models. In raw data I am getting date as YYYYMMDD, I want to convert it in DD/MM/YYYY.

Is there a simple way to convert this as there is no separator ?

Otherwise I have to separate them in 3 different fields and use it.

 ^(?<year>\d\d\d\d)(?<month>\d\d)(?<day>\d\d)

Example : 20180112 to 12/01/2018
Thanks

0 Karma
1 Solution

mayurr98
Super Champion

Try this run anywhere search

| makeresults 
| eval date="20180112 20180130 20180131 20181212 20181231" 
| makemv date 
| mvexpand date 
| eval date=strftime(strptime(date,"%Y%m%d"),"%d/%m/%Y")

In your environment you should write,

<your_base_Search>
| eval date=strftime(strptime(date,"%Y%m%d"),"%d/%m/%Y")

The inner date is the field which have YYYYMMDD format.
let me know if this helps!

View solution in original post

mayurr98
Super Champion

Try this run anywhere search

| makeresults 
| eval date="20180112 20180130 20180131 20181212 20181231" 
| makemv date 
| mvexpand date 
| eval date=strftime(strptime(date,"%Y%m%d"),"%d/%m/%Y")

In your environment you should write,

<your_base_Search>
| eval date=strftime(strptime(date,"%Y%m%d"),"%d/%m/%Y")

The inner date is the field which have YYYYMMDD format.
let me know if this helps!

493669
Super Champion

Try this anywhere search:

| makeresults
| eval Time="20180112"
| eval time=strftime(strptime(Time,"%Y%m%d"),"%d/%m/%Y")

You can create eval field expression in data model using | eval time=strftime(strptime(Time,"%Y%m%d"),"%d/%m/%Y")

mayurr98
Super Champion

this will not work if you have Time="20180125" as the format is DD/MM/YYYY and not MM/DD/YYYY.

0 Karma

493669
Super Champion

Thanks for correction! ☺

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...