topic Re: How to change format for _time field values to display in timechart report? in Splunk Search

How to change format for _time field values to display in timechart report?

pbernardin — Mon, 28 Sep 2020 17:29:38 GMT

Hi, I am trying to create a timechart report and I want to manipulate the output of the _time field so instead of reading 8/28/14 12:00:00.000 AM that, for example, I can see 8/28/14 or Thursday. Anyone know how to do this? I am not referencing the _time field so removing/modifying it seems tough. This is the last piece of the 7 day search:

index="pan_logs" | timechart span=1d dc(src_user) as "Source" BY firewall

Thanks,
Paul

Re: How to change format for _time field values to display in timechart report?

lguinn2 — Thu, 04 Sep 2014 19:50:02 GMT

timechart implicitly references the _time field, always. BUT you can't do this

index="pan_logs" 
| timechart span=1d dc(src_user) as "Source" BY firewall
| eval _time = strftime(_time,"%A")

Sorry, I thought that would work. But you can't assign a new value to the built-in _time field. Solution? Make your own time field! Here is how:

index="pan_logs"  
| bucket _time span=1d 
| stats dc(src_user) as "Source" BY firewall
| eval newTime = strftime(_time,"%x") 
| xyseries newTime firewall Source

How this works: first it groups the _time variable by day, which you did with timechart before. Then it computes your Source statistic, but using the stats command. The eval creates the new timestamp. (Use whatever time format you like. Common Time Format Variables has more info about your options.) The last step reformats the results of the stats command so it will show up in a chart the way you want.

Re: How to change format for _time field values to display in timechart report?

pbernardin — Thu, 04 Sep 2014 20:31:00 GMT

awesome. Thank you so much

Re: How to change format for _time field values to display in timechart report?

pbernardin — Thu, 04 Sep 2014 20:59:23 GMT

actually i spoke too soon. When I tried this, my time formats were not changed, even after trying multiple variables / formats like %A , %a , etc... Maybe I need the eval in a different place? Any other ideas?

Re: How to change format for _time field values to display in timechart report?

Heff — Thu, 04 Sep 2014 23:47:15 GMT

try this:
eval n=strptime(_time," %Y-%m-%d")

Re: How to change format for _time field values to display in timechart report?

lguinn2 — Fri, 05 Sep 2014 00:36:35 GMT

Sorry, I forgot about that. I updated my answer above, so that hopefully it will work now. (I even tested it.)

Re: How to change format for _time field values to display in timechart report?

lguinn2 — Fri, 05 Sep 2014 00:37:33 GMT

Good suggestion.