how to customize time in search not in indexing time

[DataOrg]

I have a field as created time.
06-03-2018 13:03:51
06-03-2018 13:03:37
06-03-2018 13:03:38

i want only the date as "06-03-2018". i used strftime but couldnt convert it

[493669 · Accepted solution]

HI @premranjithj,
try this:

...| eval temp=split(created_time," ")| eval created_time=mvindex(temp,0)

try this run anywhere search:

|makeresults|eval created_time="06-03-2018 13:03:51"| eval temp=split(created_time," ")| eval created_time=mvindex(temp,0)

[DataOrg]

created_time
06-03-2018
12:43:56
time stamps are in single fields but time is cumng in new line. how to ignore new line timestamp

[493669]

if I understood correctly that if created_time is multivalue field then try this run anywhere search:

|makeresults|eval created_time="06-03-2018"
|append[|makeresults|eval created_time="13:03:51"]
|stats values(created_time) as created_time
| eval created_time=mvindex(created_time,0)

[DataOrg]

06-03-2018
12:43:56

time and date is a single value but time is cumng in new line.I dont want time

[493669]

have you tried this:

 ...| eval created_time=mvindex(created_time,0)

[DataOrg]

yes it not worked

[493669]

then try this regex:

...|rex field=created_time "(?<a>\S+)"

[DataOrg]

06-03-2018 13:03:51. how to change this into strftime(created_time"%y/%b/%d")

[493669]

try this:

|eval created_time=strftime(strptime(created_time,"%d-%m-%Y %H:%M:%S"),"%Y/%b/%d")