converting date as text to a time format

[kiersti]

I have this field in my logs mail_date=08 Feb 2012. But it's not logging as a date or a number so I can't run time-based queries. Is there anyway to convert this text strong to a date string?

[Brian_Osburn]

Take a look at http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/CommonEvalFunctions, specifically strptime..

So, you could do something like eval=timestamp=strptime(mail_date,"%d %b %Y")

[kiersti]

I had been struggling with the format of this specific query last night, THANK YOU.

I am trying to convert to a date format that SPLUNK can leverage a query from like search "converted_date>-30d@d" but it's not working. (I converted the time from epoch to readable, with or w/out this conversion it wasn't working.)

mail_date is the field in my logs that is the text date.

source="source.log" | eval sent_date=strptime(mail_date,"%d %b %Y") | convert timeformat="%d %b %Y" ctime(sent_date) | dedup sent_date | search sent_date>"-30d@d" | table sent_date

What am I doing wrong?