Splunk Search

converting date as text to a time format

kiersti
Engager

I have this field in my logs mail_date=08 Feb 2012. But it's not logging as a date or a number so I can't run time-based queries. Is there anyway to convert this text strong to a date string?

Tags (3)

Brian_Osburn
Builder

Take a look at http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/CommonEvalFunctions, specifically strptime..

So, you could do something like eval=timestamp=strptime(mail_date,"%d %b %Y")

kiersti
Engager

I had been struggling with the format of this specific query last night, THANK YOU.

I am trying to convert to a date format that SPLUNK can leverage a query from like search "converted_date>-30d@d" but it's not working. (I converted the time from epoch to readable, with or w/out this conversion it wasn't working.)

mail_date is the field in my logs that is the text date.

source="source.log" | eval sent_date=strptime(mail_date,"%d %b %Y") | convert timeformat="%d %b %Y" ctime(sent_date) | dedup sent_date | search sent_date>"-30d@d" | table sent_date

What am I doing wrong?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...