Splunk Search

format output of a string in a particular format?

New Member

I have a search query that returns numbers like 170503007 and 170504021 as outputs. Need to format them as 2017/05/03 007 and 2017/05/04 021

Tags (2)
0 Karma

SplunkTrust
SplunkTrust

Here's one way.

... | rex field=foo "(?<yr>\d\d)(?<mon>\d\d)(?<day>\d\d)(?<num>\d{3})" | eval output="20".yr."/".mon."/".day." ".num | ...
---
If this reply helps you, an upvote would be appreciated.
0 Karma