Getting Data In

how to change date/time format in .csv email alert?

Jaci
Splunk Employee
Splunk Employee

When I schedule the following search and send a report through email, the date/time in the attached .csv file does not show the correct format, it shows the numerical time ie. 1287990000.

index=_internal todaysBytesIndexed LicenseManager-Audit NOT source=*web_service.log | eval Daily_Indexing_Volume_in_MBs = todaysBytesIndexed/1024/1024 | timechart avg(Daily_Indexing_Volume_in_MBs) by host

Running the search in the UI and as an exported report will return a readable date.

10/25/10 00:00:00.000 AM

How do I convert the date/time format in the .csv file?

Tags (3)

southeringtonp
Motivator

One of several options:

| convert ctime(_time) as timestamp 

Also, see previous thread:
     http://answers.splunk.com/questions/6971/how-to-format-time-field-in-results-email

0 Karma

southeringtonp
Motivator

Easy enough to modify the script yourself, but agreed that at least _time specifically should be automatic. Maybe time to file another ER...

0 Karma

splunk47
New Member

@southeringtonp
can you please help in modifying the sendemail.py python script
so that job.earliestTime token will display date and time differently with proper timezone as well

0 Karma

Lowell
Super Champion

Does anyone know why this isn't handled automatically in the sendemail.py script? I mean, does anyone ever really want to see _time as an epoch value? Is this because of some kind of timezone thing?

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...