Reporting

sendemail turns dates into 0NaN-NaN-NaN NaN:NaN:NaN

BenAveling
Path Finder

If I enter "*|timechart count by host", my search returns _times like this: "2014-01-14 09:00:00".

If I enter "*|timechart count by host|sendemail ...", all the _times become "0NaN-NaN-NaN NaN:NaN:NaN".

Why is this happening?

Tags (2)
0 Karma

linu1988
Champion

Hello,
you need to format the times before you send the mail.

timechart ...|eval Time=strftime(_time,"%Y/%m/%d %T")|table Time,field1,field2
0 Karma

linu1988
Champion

I have updated the answer could you check now?

0 Karma

BenAveling
Path Finder

Doesn't help. In fact, adding fieldformat _time=... on its own is enough to turn _time into 0NaN-NaN-NaN NaN:NaN:NaN, even without the sendmail. 😕

0 Karma
Get Updates on the Splunk Community!

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...

New Splunk Innovations Enhance Performance and Accelerate Troubleshooting

Splunk is excited to announce new releases that empower ITOps and engineering teams to stay ahead in ever ...