topic Why does fieldformat not work if field is renamed? in Splunk Search

Why does fieldformat not work if field is renamed?

seomaniv — Thu, 22 Aug 2019 20:33:40 GMT

I have reviewed https://answers.splunk.com/answers/63730/using-fieldformat-and-rename.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev and that gives me a work-around, but I am wondering what is going on behind the interface that breaks "fieldformat" if the field name is then renamed for a better user experience when reviewing the dashboard? If I code my query with:

eval date=date/1000 | 
eval date=date-(strptime(strftime(date,"%Y-%m-%dT%H:%M:%S.%3N")." PDT","%Y-%m-%dT%H:%M:%S.%N%Z")-date) | 
table date, userid, username, role, page, account | 
fieldformat date=strftime(date, "%F %T") | 
rename date as "Pacific Time"

the resulting table shows the field "Pacific Time" as an epoch timestamp. If I remove the "rename" command:

eval date=date/1000 | 
eval date=date-(strptime(strftime(date,"%Y-%m-%dT%H:%M:%S.%3N")." PDT","%Y-%m-%dT%H:%M:%S.%N%Z")-date) | 
table date, userid, username, role, page, account | 
fieldformat date=strftime(date, "%F %T") |

I get the "date" field properly formatted. Why? And am I stuck with not being able to rename a field that I wish to reformat?

Thanks.

John

Re: Why does fieldformat not work if field is renamed?

richgalloway — Thu, 22 Aug 2019 20:57:17 GMT

The fieldformat command doesn't change anything - it's just creates display-time instructions. If you rename the field then the display-time instructions fail because there is no longer a field by the specified name.

The solution is to apply fieldformat to the final name of the field. fieldformat "Pacific Time" = strftime("Pacific Time", "%F %T").

Re: Why does fieldformat not work if field is renamed?

seomaniv — Mon, 26 Aug 2019 19:28:38 GMT

Thanks, Rich, but I'm still not getting it to work if I use "rename":

table Date, userid, username, role, page, account | 
rename Date as "Pacific Time", page as Path, userid as "Associate's ID", username as "Associate's Name", role as "Access Level", account as "Account Number" | 
fieldformat "Pacific Time" = strftime("Pacific Time", "%F %T")

gives me a column of "Pacific Time" that is blank, whereas:

table Date, userid, username, role, page, account | 
fieldformat Date = strftime(Date, "%F %T") | 
rename Date as "Pacific Time", page as Path, userid as "Associate's ID", username as "Associate's Name", role as "Access Level", account as "Account Number"

gives me a column named "Pacific Time" as an epoch timestamp (expected, given what you have said, though I had understood "rename" to re-name the field and drag with it all of the attributes already tied to that field), and:

table Date, userid, username, role, page, account | 
fieldformat Date = strftime(Date, "%F %T") | 
rename page as Path, userid as "Associate's ID", username as "Associate's Name", role as "Access Level", account as "Account Number"

gives me a column named Date that is formatted the way I would like. What I do not understand is why the first option gives me a blank column. It is as if, once "rename" has been run on the field, fieldformat will no longer work on that same field. Is it because "rename" changes it from an epoch timestamp to a string (or something else)?

Re: Why does fieldformat not work if field is renamed?

richgalloway — Thu, 29 Aug 2019 03:04:19 GMT

Try fieldformat "Pacific Time" = strftime('Pacific Time', "%F %T"). The single quotes tell Splunk the string is a field name and not literal text.