Reporting

using _time in a scheduled search

kagouros1
Explorer

Hi,

I have the following problem and am wondering if this is a bug or am I doing something wrong:
I use a scheduled search to find some events with a specific windows error ID. Then I look at it as a table using:

|table _time,

No I created a scheduled search based on that, where I send the result as an email with a csv-attachment.
In the csv-attachment (as opposed to the interactive version) I get the _time column filled in epoch (seconds since 1970) format instead of a human readable form that I get in the search app. Is this a bug or do I have to do something to make this work properly. Everything on 5.0.3.

Cheers,

Konstantin

Tags (1)

linu1988
Champion

Hello Konstantin,
I seems like that _time is converted to the epoch format. But if you want to show it in the conventional format. Please use the strftime() fuction before you do the table

eval TimeStamp=strftime(_time,"%d/%m/%y %H:%M:%s %p")|table TimeStamp,

Thanks

martin_mueller
SplunkTrust
SplunkTrust

In the search app you get a humanly readable conversion for _time by automagic, underneath it's epoch seconds there as well. You can verify this by adding | eval foo = _time to some query, it will show epoch seconds for fóo and humanly readable for _time.

Manually, this for-view formatting without changing the underlying value is invoked by the SPL command fieldformat, see more explanation there.

0 Karma

linu1988
Champion

Please accept the answer if it was the solution/helpful!! Thanks

0 Karma

linu1988
Champion

Happy to Help!! 🙂

0 Karma

kagouros1
Explorer

Thanks this fixes my problem. Just wondering why it is not converted to epoch if I do this from the search app. However I can work with this 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...