Splunk Search
Highlighted

Change the 'oldest' and 'latest' field values to readible time format using 'strptime' command

New Member

I'm having trouble changing the 'oldest' and 'latest' field values from epoch time to readible time format using 'strptime' command:

| dbinspect index= | stats min(startEpoch) as oldest max(endEpoch) as latest by index | join type=outer [| rest /services/data/indexes/ | fields title currentDBSizeMB frozenTimePeriodInSecs maxTotalDataSizeMB | rename title as index] | eval premature_aging=if(((now() - 188697600)*1.1) < oldest,"smoke…fire?","aging nicely")

I would appreciate if anyone could help me out.

0 Karma
Highlighted

Re: Change the 'oldest' and 'latest' field values to readible time format using 'strptime' command

SplunkTrust
SplunkTrust

The command to use here is strftime (epoch to string) not strptime (string to epoch), or use convert command's ctime funtion.

Try like this

| dbinspect index= | stats min(startEpoch) as oldest max(endEpoch) as latest by index | join type=outer [| rest /services/data/indexes/ | fields title currentDBSizeMB frozenTimePeriodInSecs maxTotalDataSizeMB | rename title as index] | eval premature_aging=if(((now() - 188697600)*1.1) < oldest,"smoke…fire?","aging nicely") | convert ctime(oldest) ctime(latest) timeformat="%F %T"
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.