topic Re: Why does my date format change when downloading CSV? in Splunk Search

Why does my date format change when downloading CSV?

splunkcol — Wed, 19 Oct 2022 02:46:53 GMT

Hello,

When I run a query I get the results as I need them in a table from Splunk but when I download the .csv file, the timestamp field changes to an incorrect date and year.

Does anyone know how I can fix it?

Re: Why does my date format change when downloading CSV?

bowesmana — Wed, 19 Oct 2022 03:16:15 GMT

Looks like you're loading it into Excel, so Excel is trying to figure out what

Oct 15 00:03:53

is. It is interpreting it as MMM YY HH:MM:SS

You will need to open the CSV and tell Excel what format your time is rather than allowing it to determine it automatically

Re: Why does my date format change when downloading CSV?

splunkcol — Wed, 19 Oct 2022 03:41:23 GMT

Hi, thanks for replying, is it possible with a |eval that you suggest me to modify the order of the date in which excel does not generate me that error?

I already tried to format it from excel but the problem still persists.

Re: Why does my date format change when downloading CSV?

bowesmana — Wed, 19 Oct 2022 04:14:59 GMT

Is your timestamp in that format or have you formatted it like that - where is your year?

If you have an epoch date/time, then probably the most portable date format is ISO8601, i.e.

YYYY-MM-DD HH:MM:SS

which is done with

| eval timestamp=strftime(_time, "%F %T")

but it will depend on what time field you have to play with and whether you also have/want milliseconds

See strftime documentation