Getting Data In

Why isn't this eval'd field available?

LordVoldemort
Explorer

I've got a query like this:

sourcetype=blahdeblah earliest=... latest=...
| stats ....
| join ..[ search ... | more stats ... ]
| eval date_numericmonth=strftime(_time,"%m")
| sort date_year desc, date_numericmonth desc, date_mday asc
| table fields .... date_year, date_month, date_mday, date_numericmonth

Why is date_numericmonth empty in the resulting table? The sorting works as you would expect, and date_month shows up in the table just fine, so the date_numericmonth has a meaningful value, but for some reason I can't get it to show up in the results.

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

What fields are in the stats commands? Note that if _time is not a field output from stats, then the eval will yield a null. Also note that the date_* fields are basically independent of the _time field (and in fact may not be the same, since _time is UTC, while date_* is event text time) so even if they're there, time may not be.

0 Karma

LordVoldemort
Explorer

The sorting is a bit complicated, look at the asc, and desc's. Mostly though, I want to use the date_numericmonth in the splunk results and I can't if it isn't being returned.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

I guess I don't see why you wouldn't just | sort - _time instead.

0 Karma

LordVoldemort
Explorer

The stats is using the date_x fields, but the thing that confuses me is that the date_numericmonth is working for the sort command. I didn't realize that _time was necessary in UTC though. It seems like I might be better off extracting all of my date fields through evals()s, and if I understand correctly, all I need to do to make sure I can return all of them is aggregate by them in the stats command.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...