I need to convert a date string from the form: "Jan 07, 2016 12:12:12 EDT" (from a nessus report) to a simple 2016-01-07. I have the match logic solved in sed (and python and awk) and the conversion logic also solved (outside of sed) with the use of the date command: date "Jan 07, 2016 12:12:12 EDT" +%Y-%m-%d

I am using match groups to capture the month, day and year so I can refer to them in back references. I just cannot seem to find the correct combination of quotes to get the data command to recognize the arguments in the RHS of a sed match, e.g.:

sed -E "s/(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)(\s[0-9]{1,2}[,].[0-9]{1,4}.?[0-9]{1,2}.[0-9]{1,2}.[0-9]{1,2}.\w{3})/`date -d "\1\2" "+%Y-%m-%d"`/g" 20170917.csv

Note using any quoting, results in date ignoring the first argument and printing today's date according to the second argument.

I have iterated through using ",',\",\' to surround the backrefs \1 and \2 but it seems that as soon as they are enclosed in back ticks, `` to allow the date command to be executed, they are ignored.

Input is csv from Tenable Nessus report.

head tmp/20180121.csv

(1) "Plugin","Plugin Name","Family","Severity","IP Address","Protocol","Port","Exploit?","Repository","MAC Address","DNS Name","NetBIOS Name","Plugin Text","First Discovered","Last Observed","Mitigated On","Exploit Frameworks"

(2) "73571","Oracle Java SE Multiple Vulnerabilities (April 2014 CPU) (Unix)","Misc.","Critical","","TCP","0","Yes","Individual Scan","00:50:56:c0:00:01","host.example.com","","Plugin Output: The following vulnerable instance of Java is installed on the remote host :

Path : /opt/Geneious_linux64_7_1_9_with_jre/ Installed version : 1.7.0_51 Fixed version : 1.5.0_65 / 1.6.0_75 / 1.7.0_55 / 1.8.0_5","Jan 21, 2018 22:14:50 EST","Jan 21, 2018 22:14:50 EST","",""

Each numbered line is a record -- (1) is the header, and (2) is representative of the remainder.

The Date strings to be converted are in the last line of row 2. I need this be simply: 2018-01-21 in both cases.

  • 1. Only gnu sed can do this via the e flag. 2. Even then, you're using the wrong tool for this job: awk, perl, python etc are much better tools for this task... Commented Sep 7, 2018 at 20:22
  • Or use dateutils, specifically dconv.
    – Wildcard
    Commented Sep 7, 2018 at 20:23
  • 1
    ... and btw, that's the RHS not the LHS... Commented Sep 7, 2018 at 20:28
  • Roger, RHS, I meant that... ;)
    – Rohn Wood
    Commented Sep 7, 2018 at 20:35

1 Answer 1


A common way to do it is to add a translation table and use back-references:

echo 'Jan 07, 2016 12:12:12 EDT' | sed -E '
  s/^(...) (..), (....).*\1(..).*/\3-\2-\4/'

If you wanted to have sed run date to translate the date, you'd have to use a GNU extension: the e flag of the s command (and also the GNU date extension -d).

echo 'Jan 07, 2016 12:12:12 EDT' | sed -E '
  s/^([[:alpha:]]{3} [[:digit:]]{2}, [[:digit:]]{4}).*$/date -d "\1" +%F/e'

Though than means running a shell and date for each line of input, which is pretty inefficient (and also dangerous as we're having sh interpret code that is dynamically generated based on input which we don't know whether we can trust or not). You might as well use a text processor that can do the translation by itself like perl, if you don't want to implement it in sed.

  • Good advise all around. Also, much cleaner regex. My failure for not reading closer into sed to discover the 'e' flag. I think we can close this off. I appreciate everyone's attention and responses.
    – Rohn Wood
    Commented Sep 7, 2018 at 22:46
  • @RohnWood, note that StackExchange is more like a wiki than a support request site. We don't close off requests there. As the original poster, you can accept one of the answers (using the tick box) which indicates that you are happy with the answer given and think it's the best for your need, but that doesn't stop people from suggesting other answers which may be useful to you or other people with similar needs. Questions may be closed through a voting system if they're deemed inappropriate by the community but that's not the case here. Commented Sep 7, 2018 at 23:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .