topic Re: fieldformat command giving error in Splunk Search

fieldformat command giving error

sscandoit — Wed, 17 Aug 2011 15:48:50 GMT

Hi,

I am using Splunk 4.1.2. I am trying to use fieldformat to format the _time to avoid converting it to string. Following is my search string:

index="someindex" sourcetype="log" | fieldformat mytime=strftime(_time,"%m/%d/%Y %k:%M") | table mytime, account_id

However I am getting the following error:

Search operation 'fieldformat' is
unknown. You might not have permission
to run this operation.

I think I am missing something here. Appreciate all the help I have got on this forum.

Thanks,
Suvelee

Re: fieldformat command giving error

bbingham — Thu, 18 Aug 2011 05:06:39 GMT

use "convert", try this:

index="someindex" sourcetype="log" | convert timeformat="%m/%d/%Y %k:%M" ctime(_time) AS mytime |table mytime, account_id

the function "ctime" is for converting epoch time to ascii. Hope it helps!

Re: fieldformat command giving error

sscandoit — Thu, 18 Aug 2011 19:11:16 GMT

Thanks for the reply. I had used convert before. But it doesn't sort the timestamp in the results table. So to preserve the timestamp I tried using fieldformat.

Re: fieldformat command giving error

bbingham — Mon, 28 Sep 2020 09:48:48 GMT

You can also pipe to "sort" to order it how you'd like, but try this:

| eval start_time=_time|fieldformat start_time = strftime(start_time,"%m/%d/%Y %k:%M")

Re: fieldformat command giving error

sscandoit — Mon, 28 Sep 2020 09:50:09 GMT

For some reason, I didn't get an email for this comment. I tried | eval start_time=_time|fieldformat start_time = strftime(start_time,"%m/%d/%Y %k:%M") but this didn't work either. Its giving the same error. Thanks a lot.

I can use "sort" to order the results but that will do it one time. I wanted to let the user sort the results using up/down arrows provided by the simpleResultsTable.

Re: fieldformat command giving error

Lowell — Thu, 19 Jan 2012 17:45:30 GMT

The fieldformat search command isn't supported until Splunk 4.2.