Reporting

sendemail turns dates into 0NaN-NaN-NaN NaN:NaN:NaN

BenAveling
Path Finder

If I enter "*|timechart count by host", my search returns _times like this: "2014-01-14 09:00:00".

If I enter "*|timechart count by host|sendemail ...", all the _times become "0NaN-NaN-NaN NaN:NaN:NaN".

Why is this happening?

Tags (2)
0 Karma

linu1988
Champion

Hello,
you need to format the times before you send the mail.

timechart ...|eval Time=strftime(_time,"%Y/%m/%d %T")|table Time,field1,field2
0 Karma

linu1988
Champion

I have updated the answer could you check now?

0 Karma

BenAveling
Path Finder

Doesn't help. In fact, adding fieldformat _time=... on its own is enough to turn _time into 0NaN-NaN-NaN NaN:NaN:NaN, even without the sendmail. 😕

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...