Other Usage

Why is timestamp format different in csv attachment?

xiantros
Engager

Hi All,

We are using Splunk Cloud with Enterprise Security and we have a strange issue with csv attachments that are being sent using the "Send email" alert action. The timestamp is quite different in the attached csv, compared to the search results and exported events.

Timestamp in email attachment (csv): "Sat Jun 24 08:08:40 2023"

Timestamp in search results: "2023-06-24 08:08:40"
Timestamp in exported results (as csv): "2023-06-24T08:08:40.000+0000"

Ideally we would like to have the same timestamp format as in the search results. 

Grateful if anyone could shed some light on this - we could raise a ticket with Splunk support but we thought this might be quicker! Thank you!

Labels (2)
Tags (1)
0 Karma

meetmshah
Builder

Hello @xiantros, Can you please try explicitly using strftime function and verify if it helps? Example below - 

eval Time=strftime(_time,"%m/%d/%y %H:%M:%S")

 
Please accept the answer if that helps!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...