topic Re: how to display time rightly in csv file in Splunk Search

how to display time rightly in csv file

fzfeng — Tue, 24 Apr 2018 05:45:04 GMT

hello

I export my search result to csv file

but when I open it the time just display like this

1.52E+09

index=maillog I timechart span=1d，count（eval（IP=×××）） as IP1 I outputcsv IP1

Re: how to display time rightly in csv file

ssadanala1 — Tue, 24 Apr 2018 05:56:17 GMT

Are you seeing the issue when you are running |inputcsv IP1 .?

My understanding is that you are seeing the display 1.52E+09 when you download and open in excel .
If that is the case please increase the width size of the cell which gives excel enough space to display the value .

Thanks

Re: how to display time rightly in csv file

mayurr98 — Tue, 24 Apr 2018 06:08:26 GMT

Can you try this :

This is more efficient

index=maillog IP=XXXX | bin _time span=1d | stats count as IP1 by _time

Re: how to display time rightly in csv file

fzfeng — Tue, 24 Apr 2018 07:32:54 GMT

thank you I tried it

and i set the time range one month

the graph it displaied 3/27 3/29 3/31 4/2 4/4 .....

but the table displaied 3/37 3/28 3/29 3/31 4/1 4/2 ....

Re: how to display time rightly in csv file

janispelss — Tue, 24 Apr 2018 07:42:31 GMT

If the table has all the days, then everything is correct. The graph has all data points, it's just that not all labels are shown.

Re: how to display time rightly in csv file

fzfeng — Tue, 24 Apr 2018 07:48:35 GMT

OK thank you very much

Re: how to display time rightly in csv file

TISKAR — Tue, 24 Apr 2018 08:12:55 GMT

@fzfeng, can you try | convert ctime(_time) please, that work for me:

index=_internal
| timechart span=1d count(eval(log_level=INFO)) as countInfo 
| convert ctime(_time)
| outputcsv  tst.csv