My ldap search for last logon (Active Directory) displays time in a format that makes it harder to read. How can I make the time to be represented as MM-DD-YYYY and XX:XX AM OR PM format? Below is a sample output. Thanks
lastLogonTimestamp: 2015-09-09T19:27:23.641679Z
Assuming the lastLogonTimestamp is an extracted field, try this
..your base search | eval lastLogonTimestamp =strftime(strptime(lastLogonTimestamp,"%Y-%m-%dT%H:%M:%S.%QZ"),"%m-%d-%Y %H:%M %p")
Tested by this runanywhere search sample
| gentimes start=-1 |eval lastLogonTimestamp ="2015-09-09T19:27:23.641679Z" | eval lastLogonTimestamp =strftime(strptime(lastLogonTimestamp,"%Y-%m-%dT%H:%M:%S.%QZ"),"%m-%d-%Y %H:%M %p")
Assuming the lastLogonTimestamp is an extracted field, try this
..your base search | eval lastLogonTimestamp =strftime(strptime(lastLogonTimestamp,"%Y-%m-%dT%H:%M:%S.%QZ"),"%m-%d-%Y %H:%M %p")
Tested by this runanywhere search sample
| gentimes start=-1 |eval lastLogonTimestamp ="2015-09-09T19:27:23.641679Z" | eval lastLogonTimestamp =strftime(strptime(lastLogonTimestamp,"%Y-%m-%dT%H:%M:%S.%QZ"),"%m-%d-%Y %H:%M %p")
Thanks for the timely response, it worked. The lastlogonTimestamp is an extracted field