I have a conversion set up to change the epoch time | convert ctime(_time) as date time
. I would like to keep just the date and ditch the time function.
The field looks like this: 10/20/2015 06:30:15
Thank you for any help
Hi @ECovell
You could use the timeformat argument for convert to specify the format you want right away.
|convert timeformat="%m/%d/%Y" ctime(_time) AS date
Or you could use the eval strftime function instead and specify the format.
|eval date=strftime(_time, "%m/%d/%Y")
Hi @ECovell
You could use the timeformat argument for convert to specify the format you want right away.
|convert timeformat="%m/%d/%Y" ctime(_time) AS date
Or you could use the eval strftime function instead and specify the format.
|eval date=strftime(_time, "%m/%d/%Y")
Thank you so very much!!
You're very welcome 🙂
Hi @ppablo_splunk,
Can we use the above in alerts as well? For example:- $job.earliestTime$ gives me "2018-04-04T00:00:00.000+04:00" wheras I want only "2018-04-04".
HI everyone
did you find this answer? i am also looking for same.
covert time stamp 2023-10-20T05:30:00+05:30 to date
@AdsicSplunk @ECovell @ppablo @splunkdate