Archive

How to combine multiple time fields in order to create a full date for an event occurrence

asewell97
New Member

I currently have 3 different fields that contain parts of a date that must be put together to give a full time. I have day, hour and minute fields that are currently separate and need to be combined as I want to display the time an event occurred in a table.

1. Field 1 = day
2. Field 2 = hour
3. Field 3 = minute

I need it to be:

1. Field 1 = day:hour:minute

If someone could help with this it would be much appreciated.

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

HI asewell97,
are youspeking of search time or index time? in other words: did you already indexed data and you want to display date field or you want to index events setting the correct timestamp using the three fields?

If you're working at search time, it's easy, use eval command in your searches:

| eval my_date=field1." ".field2.":".field3

If instead you are speaking of index time, please share an example of your logs to create the correct TIME_FORMAT option.

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI asewell97,
are youspeking of search time or index time? in other words: did you already indexed data and you want to display date field or you want to index events setting the correct timestamp using the three fields?

If you're working at search time, it's easy, use eval command in your searches:

| eval my_date=field1." ".field2.":".field3

If instead you are speaking of index time, please share an example of your logs to create the correct TIME_FORMAT option.

Ciao.
Giuseppe

View solution in original post

0 Karma

asewell97
New Member

Hi, the eval command was what I was looking for. I've got it all working now so thanks for the help.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use concatenation.

... | eval field=field1.":".field2.":"field3
---
If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!