topic Re: rename command is changing time format in Splunk Search

rename command is changing time format

shakSplunk — Tue, 17 Aug 2021 00:12:18 GMT

Hi all,

I have a field that has a time value such as (_time field):

2021-08-12 15:18:42

However, when I got to use the rename command on the _time field, it changes the format to:

1628723833

Any assistance in how to NOT make the date format change whilst also renaming the field would be greatly appreciated.

tscroggins — Tue, 17 Aug 2021 00:42:07 GMT

_time is an epoch value internally, but splunkweb provides default formatting for _time. That formatting is lost if you rename the field.

You can restore formatting in tables with fieldformat:

| rename _time as t
| fieldformat t=strftime(t, "%F %T")

If you want to treat t as a string, you can convert the value:

| eval t=strftime(t, "%F %T")

shakSplunk — Tue, 17 Aug 2021 02:48:39 GMT

Thanks for the answer! It works when the rename label is one word however when there are whitespaces, it doesn't seem to work. E.g.

| rename _time as "Latest Log Timestamp"
| fieldformat 'Latest Log Timestamp'=strftime(t, "%F %T")

bowesmana — Tue, 17 Aug 2021 02:57:53 GMT

You left 't' in the strftime. Your statements should be

| fieldformat "Latest Log Timestamp"=strftime('Latest Log Timestamp', "%F %T")

i.e. double quotes on the left hand side and single quotes on the right hand side

shakSplunk — Tue, 17 Aug 2021 03:00:07 GMT

Good spot, cheers