I have this is a search:
...
|eval phaseD_time=if(searchmatch("SERVICE_INSTANCE,MESSAGE_RECEIVED,SERVICE_REQUEST"), _time, null())
..
|table phaseD_time
When I get this report, I am getting the TIME value like this:
1393347208.426
How would I get this in some sort of normal format like "mm-dd-YYYY HH:MM:sec"??
Try '... | eval phaseD_timestr=strftime(phaseD_time,"%m-%d-%Y %H:%M:%S" | table phaseD_timestr
'. Note that if phaseD_time
is null then phaseD_timestr
will also be null.
Glad to hear it. Please accept the answer.
Awesome -- thanks.
I actually shortened it to:
eval phaseB_time=strftime(if(searchmatch("LOAD_BALANCER,MESSAGE_RECEIVED,SERVICE_REQUEST"), _time, null()), "%m-%d-%Y %k:%M:%S.%N")
and it does work.
Thanks!!!