Splunk Search

Changing the time format form a log file using eval.

pete_charlton
Explorer

I am running a report that outputs a date and time format form one of my logs, and sending it in email to a customer. they cannot create a pivot table off the time as excel does not recognize the format. I am attemtping to change the date/time stamp field to a new value (logintime) with the new date format.

Any help would be greatly appreciated.

index=indexname Field=Value | eval logintime = strptime(timefield, "%a %b %d:%H:%M:%S %Z %Y") | eval desired_time=strftime(logintime, "%d/%m/%Y %I:%M:%S %p") | fields - logintime | stats count by UserData_LastName logintime

Current time format=Thu Nov 06 11:03:18 EST 2014

Tags (2)
0 Karma
1 Solution

wpreston
Motivator

Which part of your search isn't working? Creating a new time field? Or just reporting it?

The first thing I would do would be to change the stats portion of your search. You are getting rid of the logintime field with the fields command, so when you reference it later in your stats command, there won't be anything there.

Is timefield in your first eval is the same thing as the event's time (i.e. _time)? If so, you could do something like this:

index=indexname Field=Value | eval desired_time=strftime(_time, "%d/%m/%Y %I:%M:%S %p") | stats count by UserData_LastName desired_time

View solution in original post

0 Karma

wpreston
Motivator

I think all you need to do now is change your stats command to use desired_time instead of logintime. Your are eval'ing logintime to epoch format, then from it creating a new field in human readable format called desired_time, but you're still referencing the epoch time field in stats.

0 Karma

pete_charlton
Explorer

Thank you both! that did the trick

0 Karma

wpreston
Motivator

Which part of your search isn't working? Creating a new time field? Or just reporting it?

The first thing I would do would be to change the stats portion of your search. You are getting rid of the logintime field with the fields command, so when you reference it later in your stats command, there won't be anything there.

Is timefield in your first eval is the same thing as the event's time (i.e. _time)? If so, you could do something like this:

index=indexname Field=Value | eval desired_time=strftime(_time, "%d/%m/%Y %I:%M:%S %p") | stats count by UserData_LastName desired_time
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The strptime format string has an extra colon in it. Try '%a %b %d %H:%M:%S %Z %Y'. Also, the stats command refers to logintime which was dropped by the preceding fields command.

---
If this reply helps you, Karma would be appreciated.
0 Karma

pete_charlton
Explorer

Thanks Rich,

My output seems to show up in epoch time.

Time format after execution1415328453.000000

eval logintime = strptime(responseIssueInstant, "%a %b %d %H:%M:%S %Z %Y") | eval desired_time=strftime(logintime, "%d/%m/%Y %I:%M:%S %p") | stats count by UserData_LastName logintime

pete_charlton gravatar image

Answer by pete_charlton
2 secs ago
Add comment · Accept

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The stats command is displaying logintime, which is epoch time (the output of strptime()). To see the desired time string, put desired_time in the stats command.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...