topic Re: fieldformat not working? in Splunk Search

fieldformat not working?

bojanz — Fri, 27 Dec 2013 19:59:25 GMT

I'm using fieldformat (Splunk 5.0.5, search head in a cluster, if that matters) in order to change how the time is displayed and to preserve proper sorting in tables, however it appears that it does not work correctly at all (sorting still fails).

Here's what I'm doing:

index=windows source="wineventlog:security" "EventCode=644" OR "EventCode=4740" | fieldformat Time=strftime(_time, "%d.%m.%Y %H:%M:%S") | table _time Time host Account_Name

This displays a table that uses both the original _time and Time. The Time variable is properly displayed but sorting by it fails.

If I do this:

index=windows source="wineventlog:security" "EventCode=644" OR "EventCode=4740" | fieldformat _time=strftime(_time, "%d.%m.%Y %H:%M:%S") | table _time host Account_Name

Then time is completely lost and all entries show as 1/1/01 12:00:00.000 AM.

Any clues?

Re: fieldformat not working?

lguinn2 — Sat, 28 Dec 2013 18:31:11 GMT

fieldformat creates a representation (usually a string) for a field that is independent of its underlying value. The _time field is an internal field, and it cannot have such a representation.

Your first search gives you a representation for Time but not an underlying value that is sortable; it is simply a string. That is why it doesn't sort properly.

Your second search attempts to assign a string representation to the internal variable _time; this doesn't work.

To get what you want, try

index=windows source="wineventlog:security" EventCode=644 OR EventCode=4740 
| eval Time=_time
| fieldformat Time=strftime(Time, "%d.%m.%Y %H:%M:%S") 
| table Time host Account_Name

Re: fieldformat not working?

bojanz — Mon, 30 Dec 2013 10:23:42 GMT

Nope, this still doesn't work for me. The Time field is empty (no content at all).
If I put fieldformat Time=strftime(_time ...) then sorting doesn't work.

Re: fieldformat not working?

lguinn2 — Tue, 31 Dec 2013 18:17:24 GMT

Sorry, there was a typo in my answer. I then tested this on my Splunk and it works.

Re: fieldformat not working?

linu1988 — Mon, 28 Sep 2020 15:33:37 GMT

index=windows source="wineventlog:security" "EventCode=644" OR "EventCode=4740" | eval Time=strftime(_time, "%d.%m.%Y %H:%M:%S")|fields - _time| sort + Time | table Time host Account_Name

Works in Splunk 6, not sure where the sorting fails!