topic Re: Why does the date format in scheduled csv report change in an email? in Getting Data In

Why does the date format in scheduled csv report change in an email?

mcastino — Tue, 20 Aug 2019 01:55:41 GMT

I have made a scheduled report which emails a csv file containing counts of particular events for each day in the last seven days.

The format looks a little like this:

Date - X, Y, Z
2019-08-12 - 5, 6, 8
2019-08-13 - 10, 8, 7
2019-08-14 - 2, 1, 1

The output in the Splunk UI shows dates correctly ( | fieldformat Date= strftime(Date, "%Y-%m-%d" ), and when I download a CSV report manually the dates also look fine.

However, in the scheduled report sent via email, dates are presented as below:

Date
1565532000
1565618400
1565704800
1565791200
1565877600
1565964000
1566050400

Any thoughts on what's going on here?

Thanks!

Re: Why does the date format in scheduled csv report change in an email?

woodcock — Tue, 20 Aug 2019 05:36:15 GMT

The actual data is still an integer. Generally you should be using fieldformat the way that you are, but if the output is going to be exported and you need human-readable dates, then swap fieldformat for eval like this:

... | eval Date=strftime(Date, "%Y-%m-%d")

Re: Why does the date format in scheduled csv report change in an email?

mcastino — Tue, 20 Aug 2019 08:38:40 GMT

Thanks, will see how it goes!

Re: Why does the date format in scheduled csv report change in an email?

woodcock — Tue, 03 Sep 2019 14:12:19 GMT

Come back and let us know how it went and click Accept to close the question.