Following are different ways
1) Using eval command
...| eval ProperDate=replace(tostring(NumericDate),"(\d{4})(\d{2})(\d{2})","\1-\2-\3" )
...| eval ProperDate=strftime(strptime(NumericDate,"%Y%m%d"),"%Y-%m-%d"))
2) Using rex command (overwrite the same field)
...| rex field=NumericDate mode=sed "s/(\d{4})(\d{2})(\d{2})/\1-\2-\3/g"
Following are different ways
1) Using eval command
...| eval ProperDate=replace(tostring(NumericDate),"(\d{4})(\d{2})(\d{2})","\1-\2-\3" )
...| eval ProperDate=strftime(strptime(NumericDate,"%Y%m%d"),"%Y-%m-%d"))
2) Using rex command (overwrite the same field)
...| rex field=NumericDate mode=sed "s/(\d{4})(\d{2})(\d{2})/\1-\2-\3/g"
Thank you guys, i tried the solution of @somesoni2 and it workes nicely.
Thanks again.
Hi @isedrof,
Have you tried the "convert" command to convert the numeric fields to dates? Here is some documentation for the command and for date and time variables:
http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/Convert
http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/Commontimeformatvariables
Hope this helps!
All best,
@frobinson_splunk