I have a search query that returns numbers like 170503007 and 170504021 as outputs. Need to format them as 2017/05/03 007 and 2017/05/04 021
Here's one way.
... | rex field=foo "(?<yr>\d\d)(?<mon>\d\d)(?<day>\d\d)(?<num>\d{3})" | eval output="20".yr."/".mon."/".day." ".num | ...