Reporting

OutputCSV result is different than Splunk display

mhng
New Member

Hi,

I've tried to query search command on Splunk which is (CALL_STOPPED OR CALL_SUCCESSFUL) COMLib earliest=11/11/2014:00:00:00 | timechart span=1d count AS "Calls"The result display in Splunk will be two columns ( _time, Calls).

Eg. _time Calls
2014-11-11 30

But when I tried to export to CSV via this command (CALL_STOPPED OR CALL_SUCCESSFUL) COMLib earliest=11/11/2014:00:00:00 | timechart span=1d count AS "Calls"| outputcsv result.csv, the CSV will display another format.

Eg. _time Calls _span _spandays
1415635200 0 86400 1

Can I know why this happening?

Tags (2)
0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

As Martin points out, you want to change the epoch(unix) time format to human readable. Your search should become something like this:

 (CALL_STOPPED OR CALL_SUCCESSFUL) COMLib earliest=11/11/2014:00:00:00 | timechart span=1d count AS "Calls" | eval _time=humanreadabletime  | fieldformat humanreadabletime = strftime(humanreadabletime, "%F %T.%3N") | table humanreadabletime Calls |  outputcsv result.csv

View solution in original post

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

As Martin points out, you want to change the epoch(unix) time format to human readable. Your search should become something like this:

 (CALL_STOPPED OR CALL_SUCCESSFUL) COMLib earliest=11/11/2014:00:00:00 | timechart span=1d count AS "Calls" | eval _time=humanreadabletime  | fieldformat humanreadabletime = strftime(humanreadabletime, "%F %T.%3N") | table humanreadabletime Calls |  outputcsv result.csv

View solution in original post

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Field names with "_"'s in them are internal fields in Splunk. Outcsv is ouputing those as you have not formatted the search to only use those fields. So your search should be:

(CALL_STOPPED OR CALL_SUCCESSFUL) COMLib earliest=11/11/2014:00:00:00 | timechart span=1d count AS "Calls"| table _time Calls | outputcsv result.csv

That will output to csv the proper fields you want to see.

martin_mueller
SplunkTrust
SplunkTrust

That's the underlying timestamp representation as unix timestamps. You can format that manually if needed, for example ... |fieldformat field = strftime(field, "%F %T.%3N") will give you a date and time in human-readable format. All Splunk commands such as timechart work off the unix timestamp though, so format at the very end if needed. Additionally, the _time field should usually be formatted according to your browser's locale automatically.

0 Karma

mhng
New Member

Thanks esix_splunk,

One more question, the CSV file has output column I needed. However, on the _time column is still show 1415635200 value, instead of the date(e.g. 2014-11-11). Any comments for this issue?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.