topic Is there a numeric alternative to date_month? in Getting Data In

Is there a numeric alternative to date_month?

atornes — Thu, 27 Sep 2012 20:18:26 GMT

I'm trying to use a lookup table to get the # of days in the current month (I was told at .conf2012 that is the only way to do it). If there is an operator to return this (similar to date_mday) that would be fantastic, but if not....

I was told that the date_month field returned a numeric value for the month (i.e. September = 9) but it does not, it returns a string like "september".

Is there a numeric alternative to this operator where it would return 09 or 9?

Re: Is there a numeric alternative to date_month?

yannK — Thu, 27 Sep 2012 20:43:00 GMT

yes, use a convertion of _time field.

mysearch |  convert timeformat="%m" ctime(_time) AS date_month_numeric  | table _time date_month date_month_numeric

see http://docs.splunk.com/Documentation/Splunk/4.3.4/SearchReference/convert

Re: Is there a numeric alternative to date_month?

lguinn2 — Thu, 27 Sep 2012 20:44:14 GMT

It would be better to use

| eval month=strftime(_time,"%m")

even if date_month exists

Re: Is there a numeric alternative to date_month?

gkanapathy — Mon, 28 Sep 2020 12:31:33 GMT

correct. it is a bad idea to use the date_* fields because:

they may not exist on all events, depending how the timestamp was extracted
they are not normalized for time zone or DST, but simply have whatever value was represented in the raw event

therefore, as lguinn says, it's a lot better to derive it from _time.

but all that said, it's possible to make a lookup table to map from the english name ("september") to the number of days if you really insisted on using date_month (or used month_text=strftime(_time,"%b")

Re: Is there a numeric alternative to date_month?

gkanapathy — Thu, 27 Sep 2012 21:37:48 GMT

in general, if an eval function exists, it is preferred over a standalone search command, eg., strftime() or strptime() is slightly better than convert, case() is better than rangemap etc.

Re: Is there a numeric alternative to date_month?

gkanapathy — Thu, 27 Sep 2012 21:40:28 GMT

btw, a lookup is not the only way. you can use a case() function in the eval search command, and while it's a long expression, you can make that expression into a macro.