topic Re: how to change date/time format in .csv email alert? in Getting Data In

how to change date/time format in .csv email alert?

Jaci — Tue, 09 Nov 2010 07:16:00 GMT

When I schedule the following search and send a report through email, the date/time in the attached .csv file does not show the correct format, it shows the numerical time ie. 1287990000.

index=_internal todaysBytesIndexed LicenseManager-Audit NOT source=*web_service.log | eval Daily_Indexing_Volume_in_MBs = todaysBytesIndexed/1024/1024 | timechart avg(Daily_Indexing_Volume_in_MBs) by host

Running the search in the UI and as an exported report will return a readable date.

10/25/10 00:00:00.000 AM

How do I convert the date/time format in the .csv file?

Re: how to change date/time format in .csv email alert?

southeringtonp — Tue, 09 Nov 2010 08:44:59 GMT

One of several options:

| convert ctime(_time) as timestamp

Also, see previous thread:
http://answers.splunk.com/questions/6971/how-to-format-time-field-in-results-email

Re: how to change date/time format in .csv email alert?

Lowell — Tue, 09 Nov 2010 23:23:42 GMT

Does anyone know why this isn't handled automatically in the sendemail.py script? I mean, does anyone ever really want to see _time as an epoch value? Is this because of some kind of timezone thing?

Re: how to change date/time format in .csv email alert?

southeringtonp — Wed, 10 Nov 2010 10:38:55 GMT

Easy enough to modify the script yourself, but agreed that at least _time specifically should be automatic. Maybe time to file another ER...

Re: how to change date/time format in .csv email alert?

splunk47 — Mon, 27 Apr 2015 12:06:29 GMT

@southeringtonp
can you please help in modifying the sendemail.py python script
so that job.earliestTime token will display date and time differently with proper timezone as well