Getting Data In

Is there a numeric alternative to date_month?

atornes
Path Finder

I'm trying to use a lookup table to get the # of days in the current month (I was told at .conf2012 that is the only way to do it). If there is an operator to return this (similar to date_mday) that would be fantastic, but if not....

I was told that the date_month field returned a numeric value for the month (i.e. September = 9) but it does not, it returns a string like "september".

Is there a numeric alternative to this operator where it would return 09 or 9?

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

It would be better to use

| eval month=strftime(_time,"%m")

even if date_month exists

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

btw, a lookup is not the only way. you can use a case() function in the eval search command, and while it's a long expression, you can make that expression into a macro.

0 Karma

lguinn2
Legend

It would be better to use

| eval month=strftime(_time,"%m")

even if date_month exists

gkanapathy
Splunk Employee
Splunk Employee

correct. it is a bad idea to use the date_* fields because:

  • they may not exist on all events, depending how the timestamp was extracted
  • they are not normalized for time zone or DST, but simply have whatever value was represented in the raw event

therefore, as lguinn says, it's a lot better to derive it from _time.

but all that said, it's possible to make a lookup table to map from the english name ("september") to the number of days if you really insisted on using date_month (or used month_text=strftime(_time,"%b")

0 Karma

yannK
Splunk Employee
Splunk Employee

yes, use a convertion of _time field.

mysearch |  convert timeformat="%m" ctime(_time) AS date_month_numeric  | table _time date_month date_month_numeric

see http://docs.splunk.com/Documentation/Splunk/4.3.4/SearchReference/convert

gkanapathy
Splunk Employee
Splunk Employee

in general, if an eval function exists, it is preferred over a standalone search command, eg., strftime() or strptime() is slightly better than convert, case() is better than rangemap etc.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...