Getting Data In

How get _time vaules same format?

Sekhar
Explorer

My query index= nonjVs source = nonjavs | stats vaules(_time ) as start time values(_time) as endtime by empid 

Displayed below formate but I want to see my stat time  and end time "%m-%d-%y %H:%M:@%S"

Starttime 165575758474.67768 

End time 16777894894.67788

 

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Sekhar,

you have to use the eval command, with the strftime funtion, after the stats command:

index=nonjVs source=nonjavs 
| stats earliest(_time) AS starttime latest(_time) AS endtime BY empid 
| eval starttime=strftime(starttime,"%m-%d-%y %H:%M:%S"), endtime=strftime(endtime,"%m-%d-%y %H:%M:%S")

 Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Sekhar,

you have to use the eval command, with the strftime funtion, after the stats command:

index=nonjVs source=nonjavs 
| stats earliest(_time) AS starttime latest(_time) AS endtime BY empid 
| eval starttime=strftime(starttime,"%m-%d-%y %H:%M:%S"), endtime=strftime(endtime,"%m-%d-%y %H:%M:%S")

 Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Sekhar ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...