Hi  @gvssaicharan , Try this: | eval month=strftime(strptime(checkDate,"%Y-%m-%dT%H:%M:%S.%Q"),"%m") | eval quarter=case(month<=3,"Q1",month<=6,"Q2",month<=9,"Q3",month<=12,"Q4") | eval year=strftime(strptime(checkDate,"%Y-%m-%dT%H:%M:%S.%Q"),"%Y") | eval year_quarter=year."_".quarter BR Ralph ... View more

Thank you for the quick reply. It worked well. Can you explain why the same regex did not worked in splunk as is. You made little tweaks in the expression. ... View more