Knowledge Management

Can you do a multiline eval command in a datamodel for an eval field?

ebs
Communicator

Whenever I've created eval fields before in a data model they're just a single command. Is it possible to do a multiline eval command for a field? This is what I want to make into a single field:

| eval AEST_time=_time+36000
| convert timeformat="%Y-%m-%dT%H:%M:%S.%3Q %Z" ctime(AEST_time)
| eval epoch=strptime(AEST_time, "%Y-%m-%dT%H:%M:%S.%3Q %Z")
| eval date=strftime(epoch, "%Y-%m-%d")

Labels (3)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @ebs 

You shall get the same output with this, when you add something to _time it will be by default coverted to ePoch

 

| eval date=strftime(toNumber(_time+36000), "%Y-%m-%d")

 

 

View solution in original post

venkatasri
SplunkTrust
SplunkTrust

Hi @ebs 

You shall get the same output with this, when you add something to _time it will be by default coverted to ePoch

 

| eval date=strftime(toNumber(_time+36000), "%Y-%m-%d")

 

 

ebs
Communicator

Thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...