I am a newbie on Splunk. When I do a search on Splunk, time is shown as normal MM:DD:YYYY HH:MM:SS
format
However, when I export the file to CSV, it automatically converts time to Epoch time.
Is there a better way to achieve this? I tried saving time to different variable in the hope it saves as string. No luck with anything. Any help is much appreciated.
Thanks in advance
Seems like your search results include the _time field which shows human-readable format in Splunk visualizations (it's a special field) but holds an epoch value. When exported as csv, it's original epoch value can be seen.
If you want to export a string formatted date, then you'd need to create a formatted string out of _time field, like this
eventtype="ossec" ossec_server="*" reporting_host!=ABC integrity NOT HKEY NOT tag::eventtype=noise NOT WinEvtLog NOT repo |transaction reporting_host,file_dirname | eval time=strftime(_time,"%m/%d/%Y %H:%M:%S.%N") |fields time, reporting_host, reporting_ip, action,file_name |mvexpand file_name
Seems like your search results include the _time field which shows human-readable format in Splunk visualizations (it's a special field) but holds an epoch value. When exported as csv, it's original epoch value can be seen.
If you want to export a string formatted date, then you'd need to create a formatted string out of _time field, like this
eventtype="ossec" ossec_server="*" reporting_host!=ABC integrity NOT HKEY NOT tag::eventtype=noise NOT WinEvtLog NOT repo |transaction reporting_host,file_dirname | eval time=strftime(_time,"%m/%d/%Y %H:%M:%S.%N") |fields time, reporting_host, reporting_ip, action,file_name |mvexpand file_name
Thanks much @somesoni2. That works great.
What version of Splunk are you running on what OS and please add the search you are using - thanks.
I am running Splunk 5.0.3 on Ubuntu 12.04. My query looks like:
eventtype="ossec" ossec_server="*" reporting_host!=ABC integrity NOT HKEY NOT tag::eventtype=noise NOT WinEvtLog NOT repo |transaction reporting_host,file_dirname|fields time, reporting_host, reporting_ip, action,file_name |mvexpand file_name