https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-time-fields-in-order-to-create-a-full/m-p/501660#M195122 <P>HI asewell97,<BR /> are youspeking of search time or index time? in other words: did you already indexed data and you want to display date field or you want to index events setting the correct timestamp using the three fields?</P> <P>If you're working at search time, it's easy, use eval command in your searches:</P> <PRE><CODE>| eval my_date=field1." ".field2.":".field3 </CODE></PRE> <P>If instead you are speaking of index time, please share an example of your logs to create the correct TIME_FORMAT option.</P> <P>Ciao.<BR /> Giuseppe</P> Mon, 14 Oct 2019 14:37:12 GMT gcusello 2019-10-14T14:37:12Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-time-fields-in-order-to-create-a-full/m-p/501658#M195120 <P>I currently have 3 different fields that contain parts of a date that must be put together to give a full time. I have day, hour and minute fields that are currently separate and need to be combined as I want to display the time an event occurred in a table. </P> <P><STRONG>1. Field 1 = day<BR /> 2. Field 2 = hour<BR /> 3. Field 3 = minute</STRONG></P> <P>I need it to be:</P> <P><STRONG>1. Field 1 = day:hour:minute</STRONG></P> <P>If someone could help with this it would be much appreciated. </P> Mon, 14 Oct 2019 13:32:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-time-fields-in-order-to-create-a-full/m-p/501658#M195120 asewell97 2019-10-14T13:32:23Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-time-fields-in-order-to-create-a-full/m-p/501659#M195121 <P>Use concatenation.</P> <PRE><CODE>... | eval field=field1.":".field2.":"field3 </CODE></PRE> Mon, 14 Oct 2019 14:36:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-time-fields-in-order-to-create-a-full/m-p/501659#M195121 richgalloway 2019-10-14T14:36:41Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-time-fields-in-order-to-create-a-full/m-p/501660#M195122 <P>HI asewell97,<BR /> are youspeking of search time or index time? in other words: did you already indexed data and you want to display date field or you want to index events setting the correct timestamp using the three fields?</P> <P>If you're working at search time, it's easy, use eval command in your searches:</P> <PRE><CODE>| eval my_date=field1." ".field2.":".field3 </CODE></PRE> <P>If instead you are speaking of index time, please share an example of your logs to create the correct TIME_FORMAT option.</P> <P>Ciao.<BR /> Giuseppe</P> Mon, 14 Oct 2019 14:37:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-time-fields-in-order-to-create-a-full/m-p/501660#M195122 gcusello 2019-10-14T14:37:12Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-time-fields-in-order-to-create-a-full/m-p/501661#M195123 <P>Hi, the eval command was what I was looking for. I've got it all working now so thanks for the help.</P> Mon, 14 Oct 2019 15:12:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-multiple-time-fields-in-order-to-create-a-full/m-p/501661#M195123 asewell97 2019-10-14T15:12:44Z