topic Re: Need to add Date/Time in report in Splunk Search

Need to add Date/Time in report

runiyal — Thu, 13 Jun 2019 20:09:19 GMT

I have following record in my log -

2019-06-13 10:59:56,664 INFO [FileUploadWebScript] [http-apr-8983-exec-5] The Upload Service /filenet/service/temp/upload succeeded in 2.366000 seconds, Request: {account=0063, creator=Test, name=Itinerary}

I need a report showing a tabular report with following columns -
Name | Account | creator | uploaded On
Itinerary .... 0063..... Test...... 2019-06-13

"Upload On" should be from the start of the line i.e., "2019-06-13 10:59:56,664"

I am able to get all other columns except date/time by this query -

...| stats list(name) as "Name", list(account) as "Account", list(creator) as "Creator"

How to change this statement so that I can get "Uploaded On" too?

Thanks!

Re: Need to add Date/Time in report

Vijeta — Thu, 13 Jun 2019 20:30:24 GMT

@runiyal- Is this the value of _time ?

Re: Need to add Date/Time in report

runiyal — Thu, 13 Jun 2019 23:07:46 GMT

Vijeta, this is the time of the log entry....I may just need to show "2019-06-13" under "Uploaded On" column.

Re: Need to add Date/Time in report

anilchaithu — Wed, 30 Sep 2020 00:55:42 GMT

@runiyal - You can use eval "Uploaded On"=_time in the query to display "2019-06-13 10:59:56,664". If you want to show only Date, Use eval "Uploaded On"=strftime(_time, "%Y-%m-%d") in the query.

Re: Need to add Date/Time in report

woodcock — Fri, 14 Jun 2019 00:22:55 GMT

Try this:

... | eval uploaded_On = strftime(_time, "%Y-%m-%d %H:%M:%S")
| table Uploaded_On name account creator
| rename name AS Name account AS Account create AS Creator

Re: Need to add Date/Time in report

runiyal — Fri, 14 Jun 2019 00:43:08 GMT

Thanks Woodcock, it worked.

Re: Need to add Date/Time in report

runiyal — Fri, 14 Jun 2019 01:15:05 GMT

Hello Woodcock, somehow I am seeing some rows with Timestamp (Uploaded_ON) but no details around name, account & creator.
What we can do to make sure it shows record only if "name" is present?

Thanks!

Re: Need to add Date/Time in report

woodcock — Fri, 14 Jun 2019 14:58:45 GMT

Sure, just add | where isnotnull(name)