Getting Data In

how to change date/time format in .csv email alert?

Jaci
Splunk Employee
Splunk Employee

When I schedule the following search and send a report through email, the date/time in the attached .csv file does not show the correct format, it shows the numerical time ie. 1287990000.

index=_internal todaysBytesIndexed LicenseManager-Audit NOT source=*web_service.log | eval Daily_Indexing_Volume_in_MBs = todaysBytesIndexed/1024/1024 | timechart avg(Daily_Indexing_Volume_in_MBs) by host

Running the search in the UI and as an exported report will return a readable date.

10/25/10 00:00:00.000 AM

How do I convert the date/time format in the .csv file?

Tags (3)

southeringtonp
Motivator

One of several options:

| convert ctime(_time) as timestamp 

Also, see previous thread:
     http://answers.splunk.com/questions/6971/how-to-format-time-field-in-results-email

0 Karma

southeringtonp
Motivator

Easy enough to modify the script yourself, but agreed that at least _time specifically should be automatic. Maybe time to file another ER...

0 Karma

splunk47
New Member

@southeringtonp
can you please help in modifying the sendemail.py python script
so that job.earliestTime token will display date and time differently with proper timezone as well

0 Karma

Lowell
Super Champion

Does anyone know why this isn't handled automatically in the sendemail.py script? I mean, does anyone ever really want to see _time as an epoch value? Is this because of some kind of timezone thing?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...