Hi,
I'm new here. I want to convert the format from "Thu Jan 31 23:01:13 CET 2019" to "31 Jan 2019" in a custom date field.
How can I do that?
@egt If your time is in say variable x, then you need to use strptime to convert in time in seconds and then use strftime to convert it to format you need
eval y=strptime(x,"%a %b %d %H:%M:%S %Z %Y")|eval z= strftime(y,"%d %b %Y")
See the example created using makeresults.
|makeresults|eval x= "Thu Jan 31 23:01:13 CET 2019"| eval y=strptime(x,"%a %b %d %H:%M:%S %Z %Y")|eval z= strftime(y,"%d %b %Y")
@egt If your time is in say variable x, then you need to use strptime to convert in time in seconds and then use strftime to convert it to format you need
eval y=strptime(x,"%a %b %d %H:%M:%S %Z %Y")|eval z= strftime(y,"%d %b %Y")
See the example created using makeresults.
|makeresults|eval x= "Thu Jan 31 23:01:13 CET 2019"| eval y=strptime(x,"%a %b %d %H:%M:%S %Z %Y")|eval z= strftime(y,"%d %b %Y")
Try this query:
... | eval time = strftime(strptime(existingTimeField, "%a %b %d %H:%M:%S %Z %Y"), "%d %b %Y") | ...
Hi @egt
Try like
| makeresults
| eval date="Thu Jan 31 23:01:13 CET 2019"
| eval epoch = strptime(date,"%a %b %d %H:%M:%S %Z %Y")
| eval new_date =strftime(epoch,"%d %b %Y")
Hi
Try this
| eval new_time = strftime(yourtimefield, "%d %b %Y")