https://community.splunk.com/t5/Splunk-Search/How-to-automatically-calculate-an-eval-expression/m-p/131948#M35985 <P>define it in props.conf</P> Sun, 31 May 2015 13:26:28 GMT kheli 2015-05-31T13:26:28Z https://community.splunk.com/t5/Splunk-Search/How-to-automatically-calculate-an-eval-expression/m-p/131947#M35984 <P>Hi everyone,<BR /> I use the following eval expression to convert epoch time to human readable format when I search:</P> <PRE><CODE>... | eval formatted_time=strftime(old_time/1000, "%H:%M:%S %d-%m-%Y") </CODE></PRE> <P>*old_time = time in epoch format.</P> <P>Is it possible to do it permanent ?<BR /> I mean- To calculation it automatically and not use all the time with the above search ?</P> Sun, 31 May 2015 11:22:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-automatically-calculate-an-eval-expression/m-p/131947#M35984 bugnet 2015-05-31T11:22:56Z https://community.splunk.com/t5/Splunk-Search/How-to-automatically-calculate-an-eval-expression/m-p/131948#M35985 <P>define it in props.conf</P> Sun, 31 May 2015 13:26:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-automatically-calculate-an-eval-expression/m-p/131948#M35985 kheli 2015-05-31T13:26:28Z https://community.splunk.com/t5/Splunk-Search/How-to-automatically-calculate-an-eval-expression/m-p/131949#M35986 <P>Yes, Splunk supports this via a feature called "calculated fields" in props.conf. To do this for a source type called my_custom it would look like this</P> <P><CODE>[my_custom]<BR /> EVAL-formatted_time=strftime(old_time/1000, "%H:%M:%S %d-%m-%Y")</CODE></P> Sun, 31 May 2015 16:31:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-automatically-calculate-an-eval-expression/m-p/131949#M35986 bwooden 2015-05-31T16:31:53Z https://community.splunk.com/t5/Splunk-Search/How-to-automatically-calculate-an-eval-expression/m-p/131950#M35987 <P>you can also find it in the UI under fields &gt; calculated fields.</P> Mon, 01 Jun 2015 05:58:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-automatically-calculate-an-eval-expression/m-p/131950#M35987 yannK 2015-06-01T05:58:22Z https://community.splunk.com/t5/Splunk-Search/How-to-automatically-calculate-an-eval-expression/m-p/131951#M35988 <P>I tried to set it under $SPLUNK_HOME/etc/apps/search/local/props.conf but no works for me <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Wed, 03 Jun 2015 07:10:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-automatically-calculate-an-eval-expression/m-p/131951#M35988 bugnet 2015-06-03T07:10:59Z https://community.splunk.com/t5/Splunk-Search/How-to-automatically-calculate-an-eval-expression/m-p/131952#M35989 <P>@bugnet, what does the props look like? You may want to implement it in the UI per yannK's comments (In "Settings" menu).</P> Wed, 03 Jun 2015 07:51:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-automatically-calculate-an-eval-expression/m-p/131952#M35989 bwooden 2015-06-03T07:51:22Z