topic Re: Remove Time from results in Getting Data In

Remove Time from results

pboynton63 — Wed, 24 Aug 2016 21:07:28 GMT

Since a picture speaks a thousand words here is what my current results get me:

As you can search my search gets me Date, Leased IP, and Host Name

I would like the Date field to contain only the date i.e 08/24/2016 and not the hour, minute and second. Is there a way to do that?

Thanks for any help you can throw my way,

Re: Remove Time from results

sundareshr — Wed, 24 Aug 2016 21:09:45 GMT

Add this to your search

... | eval Date=strftime(Date, "%x")

Re: Remove Time from results

pboynton63 — Wed, 24 Aug 2016 21:22:35 GMT

Thank you Sundareshr,

Here are the results of your suggestion:

It seems to have taken the date and time, and what I was looking for was just to remove the hour, minute, and second. I would still like the date e.g. 08/24/2016

But I think we are close!

Again my thanks,

Re: Remove Time from results

MuS — Wed, 24 Aug 2016 21:26:43 GMT

Skip the convert - after that you have a string and no longer an epoch value which is required by strftime() to work.

cheers, MuS

Re: Remove Time from results

pboynton63 — Wed, 24 Aug 2016 21:35:50 GMT

I removed the convert piece as you suggested. That does not seem to have worked if I understood you correctly.

Re: Remove Time from results

sundareshr — Wed, 24 Aug 2016 21:41:17 GMT

Instead of the convert, add this

... | eval Date=strftime(_time, "%x") | fields - _time | ...

Re: Remove Time from results

pboynton63 — Wed, 24 Aug 2016 21:44:12 GMT

That did the trick! So many thanks to everyone for the help!