How do I display the date in my report

[ttudor]

I am new to splunk and I am using the app search and reporting. I am trying to display the event date in my search results. I have three fields date_mday, date_month, date_year in the log file. I want to combine those three fields into one field that displays on the report. Any suggestions?

[jeremiahc4]

I think you want the strftime() method of the eval command;

strftime(X,Y)

This function takes an epochtime value, X, as the first argument and renders it as a string using the format specified by Y. For a list and descriptions of format options, refer to the topic "Common time format variables". This example returns the hour and minute from the _time field:

... | eval n=strftime(_time, "%H:%M")

Use the following to determine which pieces of _time to use for the date;
http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Commontimeformatvariables

It would appear %F would be what you need (i.e. | eval n=strftime(_time, "%F")

[hortonew · Accepted solution]

I think you're looking for the _time field. e.g. | table _time, field1, field2

[janderja]

I just want to add the date/time to the report to indicate when the report was created or over what period of time that pertains to the analysis.

[ttudor]

I changed the code to
| stats count by sch_id, java_version, _time | eval n=strftime(_time, "%m %d, %Y" ) |

I am still getting the 2014-10-08 08:36:08

[ttudor]

Perfect thank you

[hortonew]

You're doing a stats function on the variable "_time" so it will display that. Again, you want to do your eval before your stats function, and do the stats on the new variable "n"

[ttudor]

When I run

| stats count by sch_id, java_version _time | eval _time=strftime(_time, "%H:%M")

It returns

0Nan-NaN-NaN–NaN:NaN:NaN

[hortonew]

you should be doing the stats function after the eval function. you should also declare a new time variable:

| eval newtime=strftime(_time, "%H:%M") | stats count by sch_id, java_version newtime

[ttudor]

Thanks, it pulls in the information. It displays as 2014-10-08 08:36:08. Anyway I can get it to 10/08/2014 ?

[hortonew]

| eval desired_time=strftime(_time, "%m/%d/%Y") | table desired_time, _time