topic Re: Formatting my date in Splunk Search

Formatting my date

rickettw — Tue, 29 Sep 2020 14:18:04 GMT

Below is my report but my date output is blank, i am searching for powershell events on my network and need to know what date these events occurred, any suggestions?

sourcetype="symantec:ep:risk:file" index=security_sep application_name ="*.ps1" | stats count as Event_Count values(user) as User values(computer_name) as Computer_Name values(category) as Category values(application_name) as Application_Name values(strftime(_time, "%d/%m/%Y")) as Time by ip_address| sort -Event_Count _time

Thanks much.

Re: Formatting my date

micahkemp — Thu, 01 Jun 2017 17:40:36 GMT

Your stats search named the values() function output Time, so _time isn't available. Try changing your sort to:

sort -Event_Count Time

Or change your values() function to name the field _time.

Edit: and change your values() function to use eval(), as per the answer below.

Re: Formatting my date

cmerriman — Thu, 01 Jun 2017 17:42:00 GMT

add eval into your Time command.

values(eval(strftime(_time, "%d/%m/%Y"))) as Time

Re: Formatting my date

richgalloway — Thu, 01 Jun 2017 18:04:04 GMT

I've had mixed results using eval within stats so I would use a separate eval.

 sourcetype="symantec:ep:risk:file" index=security_sep application_name ="*.ps1" | eval Time=strftime(_time, "%d/%m/%Y") | stats count as Event_Count values(user) as User values(computer_name) as Computer_Name values(category) as Category values(application_name) as Application_Name values(Time) as Time by ip_address| sort -Event_Count Time

Re: Formatting my date

woodcock — Thu, 01 Jun 2017 18:05:21 GMT

Try this:

sourcetype="symantec:ep:risk:file" index=security_sep application_name ="*.ps1"
| stats count as Event_Count list(user) as User list(computer_name) as Computer_Name list(category) as Category list(application_name) as Application_Name list(eval(strftime(_time, "%d/%m/%Y"))) as Time by ip_address
| sort -Event_Count _time