topic Re: How get _time vaules same formate in Getting Data In

How get _time vaules same format?

Sekhar — Wed, 19 Apr 2023 21:36:32 GMT

My query index= nonjVs source = nonjavs | stats vaules(_time ) as start time values(_time) as endtime by empid

Displayed below formate but I want to see my stat time and end time "%m-%d-%y %H:%M:@%S"

Starttime 165575758474.67768

End time 16777894894.67788

Re: How get _time vaules same formate

gcusello — Wed, 19 Apr 2023 08:43:05 GMT

Hi @Sekhar,

you have to use the eval command, with the strftime funtion, after the stats command:

index=nonjVs source=nonjavs | stats earliest(_time) AS starttime latest(_time) AS endtime BY empid | eval starttime=strftime(starttime,"%m-%d-%y %H:%M:%S"), endtime=strftime(endtime,"%m-%d-%y %H:%M:%S")

Ciao.

Giuseppe

Re: How get _time vaules same formate

gcusello — Sun, 23 Apr 2023 15:06:02 GMT

Hi @Sekhar ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉