Getting Data In

Why isn't this eval'd field available?

LordVoldemort
Explorer

I've got a query like this:

sourcetype=blahdeblah earliest=... latest=...
| stats ....
| join ..[ search ... | more stats ... ]
| eval date_numericmonth=strftime(_time,"%m")
| sort date_year desc, date_numericmonth desc, date_mday asc
| table fields .... date_year, date_month, date_mday, date_numericmonth

Why is date_numericmonth empty in the resulting table? The sorting works as you would expect, and date_month shows up in the table just fine, so the date_numericmonth has a meaningful value, but for some reason I can't get it to show up in the results.

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

What fields are in the stats commands? Note that if _time is not a field output from stats, then the eval will yield a null. Also note that the date_* fields are basically independent of the _time field (and in fact may not be the same, since _time is UTC, while date_* is event text time) so even if they're there, time may not be.

0 Karma

LordVoldemort
Explorer

The sorting is a bit complicated, look at the asc, and desc's. Mostly though, I want to use the date_numericmonth in the splunk results and I can't if it isn't being returned.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

I guess I don't see why you wouldn't just | sort - _time instead.

0 Karma

LordVoldemort
Explorer

The stats is using the date_x fields, but the thing that confuses me is that the date_numericmonth is working for the sort command. I didn't realize that _time was necessary in UTC though. It seems like I might be better off extracting all of my date fields through evals()s, and if I understand correctly, all I need to do to make sure I can return all of them is aggregate by them in the stats command.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...