Splunk Search

Date Format

JoeSco27
Communicator

I have a field called DATE and it is returning values yyyy-mm-dd HH:MM:SS. I am trying to chop off the hours, min, seconds so I only have yyyy-mm-dd. I have tried to use the convert command but I would rather not have to convert it to epoch time and then convert it back. Is there an easier way to go about this?

Thank you in advance

Tags (2)
0 Karma

asimagu
Builder

the most efficient way is to set up TIME_FORMAT in props.conf . That will do the magic at indexing time

0 Karma

JoeSco27
Communicator

| eval n=strptime(DATE, "%Y-%m-%d") | convert timeformat="%Y %m %d" ctime(n) AS c_time | chart count by c_time

this gave me the count for each day i requested, thank you for the help

0 Karma

JSapienza
Contributor

If Splunk is not already parsing out this field , you can use something like such:

...|rex field=DATE mode=sed "/s/\d{2}:\d{2}:\d{2}//g"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...