topic Re: VALUE FORMAT in Splunk Search

VALUE FORMAT

jip31 — Thu, 19 Jul 2018 06:25:27 GMT

i have a value like this in a field 2018067155420 and i want to format it with this format : yyyymmddhhmmss so
could you help me please??

Re: VALUE FORMAT

deepashri_123 — Tue, 29 Sep 2020 20:33:03 GMT

Hey@jip31,

You can add these attributes in your props.conf:
https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Propsconf

TIME_FORMAT =
TIME_PREFIX =

Let me know if this helps!!

Re: VALUE FORMAT

jip31 — Thu, 19 Jul 2018 09:25:45 GMT

hi
not really
i just want to format this value

Re: VALUE FORMAT

FrankVl — Thu, 19 Jul 2018 10:14:03 GMT

What do you mean by format this value? Can you give an example of the output you expect of that formatting?

Re: VALUE FORMAT

jip31 — Thu, 19 Jul 2018 11:30:44 GMT

hi
This value 20180627155420 correspond to the date 2018 06 27 and the hour 15 54 20
i would like to have finally an EVAL which does 27/06/2018 15:54
thanks

Re: VALUE FORMAT

FrankVl — Thu, 19 Jul 2018 11:43:16 GMT

Try this:

| makeresults
| eval date_time = 20180627155420
| eval formatted_date_time = strftime(strptime(date_time,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M")

First two lines are just to generate an example, you only need the last line (make sure to adjust the field names to your situation). This code parses the date-time string that you have to a unix timestamp, and then prints that timestamp as per the format you wanted.

Re: VALUE FORMAT

jip31 — Fri, 20 Jul 2018 07:26:44 GMT

i have wrote this but it doesnt works

index="windows-wmi" sourcetype="WMI:LastLogon" LastLogon | rex field=LastLogon mode=sed "s/\..*$//" | eval LastLogon = strftime(strptime(date_time,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M")

there is a mistake somewhere??

Re: VALUE FORMAT

FrankVl — Fri, 20 Jul 2018 07:47:53 GMT

Yes, like I said, you need to adjust it to your field names. So replace date_time with the field that contains your input. So looking at your example that would be LastLogon.

 index="windows-wmi" sourcetype="WMI:LastLogon" LastLogon | rex field=LastLogon mode=sed "s/\..*$//" | eval LastLogon = strftime(strptime(LastLogon,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M")

Re: VALUE FORMAT

jip31 — Fri, 20 Jul 2018 07:57:12 GMT

you are the best! thanks