topic Re: Changing date_hour format in Splunk Search

Changing date_hour format

krusovice — Tue, 29 Sep 2020 18:18:44 GMT

Hi all,

I would like to use date_hour as part of the query. The result of date_hour showing 1,2,3....23. How can I change the format of date_hour to become e.g. 1 is 1:00 to 1:59, 20 is 20:00 to 20:59?

Thanks for your help in advance.

Re: Changing date_hour format

niketn — Tue, 06 Mar 2018 03:02:10 GMT

@krusovice, you can try the following

<yourcurrentsearch>
| eval date_hour=if(len(date_hour)==1,"0".date_hour.":00",date_hour.":00")
| sort date_hour

Following is a run anywhere search based on Splunk's _internal index

index=_internal sourcetype=splunkd log_level!="INFO"
| stats count by date_hour
| eval date_hour=if(len(date_hour)==1,"0".date_hour.":00",date_hour.":00")
| sort date_hour

Re: Changing date_hour format

krusovice — Tue, 06 Mar 2018 03:30:56 GMT

Hi @niketnilay,

It's work fine to display 01:00, 02:00...etc. However my requirement is to able to display as "01:00 - 01:59", how can I achieve that?

Re: Changing date_hour format

niketn — Tue, 06 Mar 2018 03:35:43 GMT

Try the following then:

| eval date_hour=if(len(date_hour)==1,"0".date_hour.":00 - ".date_hour.":59",date_hour.":00 - ".date_hour.":59")

Re: Changing date_hour format

krusovice — Tue, 06 Mar 2018 03:44:58 GMT

Thank you so much for the answer, my result looking great now 🙂

Re: Changing date_hour format

niketn — Tue, 06 Mar 2018 03:46:22 GMT

Glad it worked 🙂