topic Re: How to format earliest_time in mstats command in Splunk Enterprise

How to format earliest_time in mstats command

perrinj2 — Mon, 18 Oct 2021 04:16:38 GMT

I'm using mstats earliest_time(metric) to find the earliest time for metric. If I use

|mstats prestats=false earliest_time("http_req_duration_value") as "Start Time" where index=au_cpe_common_metrics

it returns a "Start Time" like 1633986822.000000

I want to be able to display this time in human readable format on a dashboard however when I try

~~~

|mstats prestats=false earliest_time("http_req_duration_value") as "Start Time" where index=au_cpe_common_metrics
| eval STime2=strftime("Start Time", "%d/%m/%Y %H:%M:%S")|table STime2

~~~

I get no results.

I'd also like to be able to subtract earliest_time from latest_time to get the duration of the event based on other dimensions.

I also tried prestats = true but it returned no Time values in the events.

What format is earliest time in and why can't I format it or do calculations with the value?

What is happening here? I'm new to operating with metric indexes

Re: How to format earliest_time in mstats command

ITWhisperer — Mon, 18 Oct 2021 07:41:19 GMT

Try single quotes around the field name

| eval STime2=strftime('Start Time', "%d/%m/%Y %H:%M:%S")|table STime2

Re: How to format earliest_time in mstats command

perrinj2 — Tue, 19 Oct 2021 03:47:58 GMT

@ITWhisperer

Thanks. That fixed it. For others - Splunk resolves double quoted field names when they are used in a table command but treats them as literals when embedded in commands like stfrtime or when trying to use them in an eval statement. Easy trap to fall into

Re: How to format earliest_time in mstats command

bowesmana — Tue, 19 Oct 2021 04:23:15 GMT

@perrinj2

You should always use single quotes in eval statements for field names that do not just consist of standard letters or numbers. Also, if the field name starts with a number, you must use single quotes. However, note that the LEFT hand side of the eval statement does not use single quotes, it uses double.

To illustrate

| eval "Start Time" = strftime('Start Time', "%d/%m/%Y %H:%M:%S")

the left hand side uses double quotes, but inside the eval function, it uses single quotes.

Your example is due to the space in the field name 'Start Time'. If you had used StartTime, you would not need single quotes in the eval.

If you ever have JSON fields in your data, then you will always have to use single quotes when wrapping a field name containing a . (period)