strftime empties stats-ed field

[altink]

Hi

after I try to format datetime field - it shows empty

index=_audit action=alert_fired ss_app=omega_core_audit
| convert ctime(trigger_time)
| eval Criticality = case(severity=1,"Info", severity=2, "Low", severity=3, "Medium", severity=4,"High", severity=5, "Critical", 1=1, severity)
| stats earliest(trigger_time) as min_time, latest(trigger_time) as max_time, count by ss_name Criticality
| eval min_time = strftime(min_time,"%Y-%m-%d %H:%M:%S")

field min_time returns NULL after I try to set format.
(max_time is OK - but without format)

please advise on how to correctly output the datetime fields with desired format

regards

Altin

[altink]

even If I replace

line:

| eval min_time = strftime(min_time,"%Y-%m-%d %H:%M:%S")

with
| fieldformat min_time = strftime(min_time,"%Y-%m-%d %H:%M:%S")

still I get an empty min_time field

[altink]

can anyone advise on this ?

regards
Altin

[anilchaithu · Accepted solution]

@altink 

strftime converts UNIX time to regualr readable time. From the SPL, the min_time & max_time are already converted in line 2 of the code. Simply you can remove line 2 OR you can add the following stanzas

| eval min_time = strftime(strptime(min_time,"%m/%d/%Y %H:%M:%S"),"%Y-%m-%d"))

| eval max_time = strftime(strptime(max_time,"%m/%d/%Y %H:%M:%S"),"%Y-%m-%d"))

-- Hope this helps

[altink]

thank you

if I remove line 2 I get unix time only.

if I remove the two my last evals I get the default datime format - but what I need is a formated as below:
y-m-d H:M:S

your two proposed stanzas return NULL - with or without line 2