Getting Data In

How do I include leading 0 in the time fields

digital_alchemy
Path Finder

I would like to combine the date_hour, date_minute and date_second fields to display in the following format when using the top command: hh:mm:ss

The problem I'm having is that the output will remove any leading zeros from the minutes; so, for example instead of 12:05:02 I get 12:5:2.

This how I'm currently combining the fields:

mysearch | eval time = date_hour.":".date_minute.":".date_second | top time,src,src_port,dest,dest_port
0 Karma
1 Solution

bmacias84
Champion

The best way if possible is to convert or use epoch time with in your search. Then use strftime eval funtion to convert to the desired format.


eval time = strftime(epoch,%H:%M:%S)

additional reading:

Hope this help or gets you started. Dont forget to vote and accept answer that help.

Cheers

View solution in original post

bmacias84
Champion

The best way if possible is to convert or use epoch time with in your search. Then use strftime eval funtion to convert to the desired format.


eval time = strftime(epoch,%H:%M:%S)

additional reading:

Hope this help or gets you started. Dont forget to vote and accept answer that help.

Cheers

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!