converting lastLogonTimestamp to readable date and time format in Splunk

[samble]

My ldap search for last logon (Active Directory) displays time in a format that makes it harder to read. How can I make the time to be represented as MM-DD-YYYY and XX:XX AM OR PM format? Below is a sample output. Thanks

lastLogonTimestamp: 2015-09-09T19:27:23.641679Z

[somesoni2 · Accepted solution]

Assuming the lastLogonTimestamp is an extracted field, try this

..your base search | eval lastLogonTimestamp =strftime(strptime(lastLogonTimestamp,"%Y-%m-%dT%H:%M:%S.%QZ"),"%m-%d-%Y %H:%M %p")

Tested by this runanywhere search sample

| gentimes start=-1 |eval lastLogonTimestamp ="2015-09-09T19:27:23.641679Z" | eval lastLogonTimestamp =strftime(strptime(lastLogonTimestamp,"%Y-%m-%dT%H:%M:%S.%QZ"),"%m-%d-%Y %H:%M %p")

[samble]

Thanks for the timely response, it worked. The lastlogonTimestamp is an extracted field