topic Re: appending 2 searches + date format is lost YYYY-MM becomes YYYY in Splunk Search

appending 2 searches + date format is lost YYYY-MM becomes YYYY

HattrickNZ — Thu, 09 Feb 2017 01:35:06 GMT

I have 2 searches:

search1 and search2

search 1 gives :

_time   kpi1    kpi2    kpi3 kpi4
2016-01 493.26  636.06  56.322  1129.32

search 2 gives :

_time   kpi1    kpi2    kpi3 kpi4
2017-01 193.26  44.06   34.322  239.32

I combine them with the append (e.g. search 1 ... | append [ search2 ...])

 _time    kpi1    kpi2    kpi3 kpi4
2016    470.55  277.07  37.060  747.62
2017    193.26  44.06   34.322  239.32

but not the time format loses the month (e.g 2017-01 becomes 2017)

How do I get it to hold on to the month?

 _time    kpi1    kpi2    kpi3 kpi4
2016-01 470.55  277.07  37.060  747.62
2017-01 193.26  44.06   34.322  239.32

Re: appending 2 searches + date format is lost YYYY-MM becomes YYYY

cmerriman — Thu, 09 Feb 2017 02:06:01 GMT

can you try to put _time into epoch on both searches and then change the format to YYYY-MM after the append to see if that works?

Re: appending 2 searches + date format is lost YYYY-MM becomes YYYY

DalJeanis — Thu, 09 Feb 2017 17:21:51 GMT

If you left _time in its original, epoch format in both searches, and each search is returning only a single record, then the interface may just be guessing that you only care about the year. Tell it what you want.

| eval _time=strftime(_time,"%Y-%m")

See somesoni2's answer below, which leaves the underlying field in epoch format and probably should be the general way you do this stuff.

Re: appending 2 searches + date format is lost YYYY-MM becomes YYYY

somesoni2 — Thu, 09 Feb 2017 17:29:24 GMT

Or use the fieldformat command ( | fieldformat_time=strftime(_time,"%Y-%m") ).

Re: appending 2 searches + date format is lost YYYY-MM becomes YYYY

HattrickNZ — Thu, 09 Feb 2017 21:11:10 GMT

tks @DalJeanis, that worked.

Re: appending 2 searches + date format is lost YYYY-MM becomes YYYY

DalJeanis — Thu, 09 Feb 2017 23:26:57 GMT

Awesome! Good to hear.