https://community.splunk.com/t5/Splunk-Search/formatting-time-field-into-a-YYYY-MM-DD-field/m-p/185704#M53505 <P>Use <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Convert">convert</A>:</P> <PRE><CODE>... | convert timeformat="%Y-%m-%d" ctime(_time) AS ctime | ... </CODE></PRE> <P>You can use whatever <CODE>... AS yourfield</CODE> you want, of course.</P> Tue, 12 May 2015 02:21:23 GMT jtrucks 2015-05-12T02:21:23Z https://community.splunk.com/t5/Splunk-Search/formatting-time-field-into-a-YYYY-MM-DD-field/m-p/185701#M53502 <P>This search is ok<BR /> <CODE>... | stats max(fieldname1) as fn1 by _time</CODE> </P> <P>but I want to control the format of the _time field to be format to be YYYY-MM-DD</P> <P>How can I do this? </P> <P>I know i can do <CODE>... | timechart span=d max(fieldname1) as fn1</CODE> but i am looking for another way as it relates to something I am working on and the timechart option won't work.</P> <P>I am think something like </P> <P><CODE>... | eval time_field=(_time,"YYYY-MM-DD")| stats max(fieldname1) as fn1 by time_field</CODE> </P> <P>Can this be done? </P> Mon, 11 May 2015 20:28:27 GMT https://community.splunk.com/t5/Splunk-Search/formatting-time-field-into-a-YYYY-MM-DD-field/m-p/185701#M53502 HattrickNZ 2015-05-11T20:28:27Z https://community.splunk.com/t5/Splunk-Search/formatting-time-field-into-a-YYYY-MM-DD-field/m-p/185702#M53503 <P>think this is what I want<BR /> <A href="http://answers.splunk.com/answers/94614/how-to-extract-date-yyyymmdd-from-time.html">http://answers.splunk.com/answers/94614/how-to-extract-date-yyyymmdd-from-time.html</A></P> Mon, 11 May 2015 21:17:16 GMT https://community.splunk.com/t5/Splunk-Search/formatting-time-field-into-a-YYYY-MM-DD-field/m-p/185702#M53503 HattrickNZ 2015-05-11T21:17:16Z https://community.splunk.com/t5/Splunk-Search/formatting-time-field-into-a-YYYY-MM-DD-field/m-p/185703#M53504 <P>try this:<BR /> ... | eval time_field=strptime<BR /> (_time,"%Y-%m-%d")|<BR /> stats max(fieldname1)<BR /> as fn1 by time_field</P> Mon, 28 Sep 2020 19:52:47 GMT https://community.splunk.com/t5/Splunk-Search/formatting-time-field-into-a-YYYY-MM-DD-field/m-p/185703#M53504 stephane_cyrill 2020-09-28T19:52:47Z https://community.splunk.com/t5/Splunk-Search/formatting-time-field-into-a-YYYY-MM-DD-field/m-p/185704#M53505 <P>Use <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Convert">convert</A>:</P> <PRE><CODE>... | convert timeformat="%Y-%m-%d" ctime(_time) AS ctime | ... </CODE></PRE> <P>You can use whatever <CODE>... AS yourfield</CODE> you want, of course.</P> Tue, 12 May 2015 02:21:23 GMT https://community.splunk.com/t5/Splunk-Search/formatting-time-field-into-a-YYYY-MM-DD-field/m-p/185704#M53505 jtrucks 2015-05-12T02:21:23Z