I have a date timestamp coming in as a string in this format
2012-08-08 11:29:03.727000000
This is extracted as a field called createDtTimeStamp
I want to simply extract JUST the date part from this field and use the following query:
... | eval createDt = strftime( strptime( createDtTimeStamp, "%b %d %H:%M:%S" ), "%m/%d/%Y %p")
This does not seem to work. Any ideas why ?
Well your format string seems to be off. %b
is "Locale’s abbreviated month name." which does not match 2012-08-08. You'll likely want something like
... | eval createDt = strftime(strptime(createDtTimeStamp,"%Y-%m-%d %H:%M:%S"),"%m/%d/%Y %p")
Well your format string seems to be off. %b
is "Locale’s abbreviated month name." which does not match 2012-08-08. You'll likely want something like
... | eval createDt = strftime(strptime(createDtTimeStamp,"%Y-%m-%d %H:%M:%S"),"%m/%d/%Y %p")
worked like a charm !