Reporting

using _time in a scheduled search

Explorer

Hi,

I have the following problem and am wondering if this is a bug or am I doing something wrong:
I use a scheduled search to find some events with a specific windows error ID. Then I look at it as a table using:

|table time,<someother_fields>

No I created a scheduled search based on that, where I send the result as an email with a csv-attachment.
In the csv-attachment (as opposed to the interactive version) I get the _time column filled in epoch (seconds since 1970) format instead of a human readable form that I get in the search app. Is this a bug or do I have to do something to make this work properly. Everything on 5.0.3.

Cheers,

Konstantin

Tags (1)

Champion

Hello Konstantin,
I seems like that _time is converted to the epoch format. But if you want to show it in the conventional format. Please use the strftime() fuction before you do the table

eval TimeStamp=strftime(_time,"%d/%m/%y %H:%M:%s %p")|table TimeStamp,

Thanks

SplunkTrust
SplunkTrust

In the search app you get a humanly readable conversion for time by automagic, underneath it's epoch seconds there as well. You can verify this by adding | eval foo = _time to some query, it will show epoch seconds for fóo and humanly readable for `time`.

Manually, this for-view formatting without changing the underlying value is invoked by the SPL command fieldformat, see more explanation there.

0 Karma

Champion

Please accept the answer if it was the solution/helpful!! Thanks

0 Karma

Champion

Happy to Help!! 🙂

0 Karma

Explorer

Thanks this fixes my problem. Just wondering why it is not converted to epoch if I do this from the search app. However I can work with this 🙂

0 Karma