Getting Data In

How get _time vaules same format?

Sekhar
Explorer

My query index= nonjVs source = nonjavs | stats vaules(_time ) as start time values(_time) as endtime by empid 

Displayed below formate but I want to see my stat time  and end time "%m-%d-%y %H:%M:@%S"

Starttime 165575758474.67768 

End time 16777894894.67788

 

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Sekhar,

you have to use the eval command, with the strftime funtion, after the stats command:

index=nonjVs source=nonjavs 
| stats earliest(_time) AS starttime latest(_time) AS endtime BY empid 
| eval starttime=strftime(starttime,"%m-%d-%y %H:%M:%S"), endtime=strftime(endtime,"%m-%d-%y %H:%M:%S")

 Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Sekhar,

you have to use the eval command, with the strftime funtion, after the stats command:

index=nonjVs source=nonjavs 
| stats earliest(_time) AS starttime latest(_time) AS endtime BY empid 
| eval starttime=strftime(starttime,"%m-%d-%y %H:%M:%S"), endtime=strftime(endtime,"%m-%d-%y %H:%M:%S")

 Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Sekhar ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...