Reporting

OutputCSV result is different than Splunk display

mhng
New Member

Hi,

I've tried to query search command on Splunk which is (CALL_STOPPED OR CALL_SUCCESSFUL) COMLib earliest=11/11/2014:00:00:00 | timechart span=1d count AS "Calls"The result display in Splunk will be two columns ( _time, Calls).

Eg. _time Calls
2014-11-11 30

But when I tried to export to CSV via this command (CALL_STOPPED OR CALL_SUCCESSFUL) COMLib earliest=11/11/2014:00:00:00 | timechart span=1d count AS "Calls"| outputcsv result.csv, the CSV will display another format.

Eg. _time Calls _span _spandays
1415635200 0 86400 1

Can I know why this happening?

Tags (2)
0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

As Martin points out, you want to change the epoch(unix) time format to human readable. Your search should become something like this:

 (CALL_STOPPED OR CALL_SUCCESSFUL) COMLib earliest=11/11/2014:00:00:00 | timechart span=1d count AS "Calls" | eval _time=humanreadabletime  | fieldformat humanreadabletime = strftime(humanreadabletime, "%F %T.%3N") | table humanreadabletime Calls |  outputcsv result.csv

View solution in original post

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

As Martin points out, you want to change the epoch(unix) time format to human readable. Your search should become something like this:

 (CALL_STOPPED OR CALL_SUCCESSFUL) COMLib earliest=11/11/2014:00:00:00 | timechart span=1d count AS "Calls" | eval _time=humanreadabletime  | fieldformat humanreadabletime = strftime(humanreadabletime, "%F %T.%3N") | table humanreadabletime Calls |  outputcsv result.csv
0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Field names with "_"'s in them are internal fields in Splunk. Outcsv is ouputing those as you have not formatted the search to only use those fields. So your search should be:

(CALL_STOPPED OR CALL_SUCCESSFUL) COMLib earliest=11/11/2014:00:00:00 | timechart span=1d count AS "Calls"| table _time Calls | outputcsv result.csv

That will output to csv the proper fields you want to see.

martin_mueller
SplunkTrust
SplunkTrust

That's the underlying timestamp representation as unix timestamps. You can format that manually if needed, for example ... |fieldformat field = strftime(field, "%F %T.%3N") will give you a date and time in human-readable format. All Splunk commands such as timechart work off the unix timestamp though, so format at the very end if needed. Additionally, the _time field should usually be formatted according to your browser's locale automatically.

0 Karma

mhng
New Member

Thanks esix_splunk,

One more question, the CSV file has output column I needed. However, on the _time column is still show 1415635200 value, instead of the date(e.g. 2014-11-11). Any comments for this issue?

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...