format output of a string in a particular format?

[erhksadhwani]

I have a search query that returns numbers like 170503007 and 170504021 as outputs. Need to format them as 2017/05/03 007 and 2017/05/04 021

[richgalloway]

Here's one way.

... | rex field=foo "(?<yr>\d\d)(?<mon>\d\d)(?<day>\d\d)(?<num>\d{3})" | eval output="20".yr."/".mon."/".day." ".num | ...