Getting Data In

Why isn't this eval'd field available?

LordVoldemort
Explorer

I've got a query like this:

sourcetype=blahdeblah earliest=... latest=...
| stats ....
| join ..[ search ... | more stats ... ]
| eval date_numericmonth=strftime(_time,"%m")
| sort date_year desc, date_numericmonth desc, date_mday asc
| table fields .... date_year, date_month, date_mday, date_numericmonth

Why is date_numericmonth empty in the resulting table? The sorting works as you would expect, and date_month shows up in the table just fine, so the date_numericmonth has a meaningful value, but for some reason I can't get it to show up in the results.

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

What fields are in the stats commands? Note that if _time is not a field output from stats, then the eval will yield a null. Also note that the date_* fields are basically independent of the _time field (and in fact may not be the same, since _time is UTC, while date_* is event text time) so even if they're there, time may not be.

0 Karma

LordVoldemort
Explorer

The sorting is a bit complicated, look at the asc, and desc's. Mostly though, I want to use the date_numericmonth in the splunk results and I can't if it isn't being returned.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

I guess I don't see why you wouldn't just | sort - _time instead.

0 Karma

LordVoldemort
Explorer

The stats is using the date_x fields, but the thing that confuses me is that the date_numericmonth is working for the sort command. I didn't realize that _time was necessary in UTC though. It seems like I might be better off extracting all of my date fields through evals()s, and if I understand correctly, all I need to do to make sure I can return all of them is aggregate by them in the stats command.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...