topic timechart time format change in Splunk Search

timechart time format change

gancw1 — Tue, 14 Jan 2014 02:14:35 GMT

I am trying to tabulate number of specific operation per day using this format

timechart span=1d count as DLCreateCount

How do I replace the _time value with a human readable time format ?

Re: timechart time format change

jsie_splunk — Tue, 14 Jan 2014 02:19:13 GMT

See if Ayn's answer here works for you: http://answers.splunk.com/answers/100969/how-to-format-timechart-time-values-easily

Re: timechart time format change

linu1988 — Tue, 14 Jan 2014 03:49:24 GMT

Hello,
There are many ways.

timechart ... |convert ctime(_time)

will do it as well. But in Splunk 6 you will get it automatically.

Re: timechart time format change

gancw1 — Tue, 14 Jan 2014 09:03:26 GMT

this will create additional time column :

_time DLCreateCount Time

I would like to replace the _time with time

Re: timechart time format change

linu1988 — Tue, 14 Jan 2014 17:08:46 GMT

No it replaces the same column where you have the time column.

Re: timechart time format change

jbrodsky_splunk — Tue, 14 Jan 2014 18:39:59 GMT

You could do something like this - an example of using strftime to pull out the name of the Day and then counting over the past seven days. In this case "_time" is replaced by Day. Play with strftime and the time range to get what you want.

... earliest=-7d@d latest=now |  bucket span=1d _time | eval Day=strftime(_time, "%u. %A") |  stats count as DLCreateCount by Day

Re: timechart time format change

gancw1 — Wed, 22 Jan 2014 08:11:08 GMT

Thanks for the suggestion. I managed to get it in the format I want using this

timechart span=1d count as DLCreateCount | convert ctime(_time) as time | table time DLCreateCount

Re: timechart time format change

gcusello — Wed, 18 Jun 2014 15:43:52 GMT

I have the same problem and I cannon found a solution (also using 6.1.0.), I tried information from other answers but with no result:

I cannot use other commands because I need results in many columns, one for each User (timechart span=1w count by User)

inserting "|convert ctime(_time) as time" after the timechart command adds a column without replacing the _time column

inserting "|convert ctime(_time) as time" before the timechart command has no effect on the output

inserting "| fieldformat time=strftime(time,"%+")" before or after the timechart command I have this result for the time "0NaN-NaN-NaN NaN:NaN:NaN"

Anyone has an idea?

Thanks Giuseppe

Re: timechart time format change

3no — Mon, 03 Apr 2017 11:44:40 GMT

eval _time=strftime(_time,"%c")"