Splunk Search

converting date as text to a time format


I have this field in my logs mail_date=08 Feb 2012. But it's not logging as a date or a number so I can't run time-based queries. Is there anyway to convert this text strong to a date string?

Tags (3)


Take a look at http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/CommonEvalFunctions, specifically strptime..

So, you could do something like eval=timestamp=strptime(mail_date,"%d %b %Y")


I had been struggling with the format of this specific query last night, THANK YOU.

I am trying to convert to a date format that SPLUNK can leverage a query from like search "converted_date>-30d@d" but it's not working. (I converted the time from epoch to readable, with or w/out this conversion it wasn't working.)

mail_date is the field in my logs that is the text date.

source="source.log" | eval sentdate=strptime(maildate,"%d %b %Y") | convert timeformat="%d %b %Y" ctime(sentdate) | dedup sentdate | search sentdate>"-30d@d" | table sentdate

What am I doing wrong?

0 Karma