Splunk Search

Creating a custom date field

ebruozys
Path Finder

Hi,

Is there a way to create a custom date field in Splunk?

Sow lets say I have multiple events, all of these events have a date field CREATIONDATE. Now I want to create a new date field for events that have the action called "Validation" in them. And I would like to call this new date field VALIDATIONDATE.

I'm thinking this should be possible with the 'where' command, but I'm not certain how to use it.

0 Karma

493669
Super Champion

you can try like this:

index=indexname action="Validation"|eval VALIDATIONDATE=now()|eval VALIDATIONDATE=strftime(VALIDATIONDATE,"%d/%m/%Y %H:%M:%S")

here search for action="Validation" then create new field VALIDATIONDATE using eval function and assign it the value like here it will assign current time .

0 Karma

Richfez
SplunkTrust
SplunkTrust

What should the new date field's contents be? A copy of CREATIONDATE?

... | eval VALIDATIONDATE=CREATIONDATE

The current time?
... | eval VALIDATIONDATE=now()

Some other date relative to CREATIONDATE?
... | eval VALIDATIONDATE=relative_time(CREATIONDATE, "-1w")

If instead you are trying to create a new extraction to create this date out of some "validation date" that's inside an event, please post one of the events in question and we can totally help you with this!

0 Karma

ebruozys
Path Finder

The validation date is indeed a copy of the creationdate, but as I mentioned above it should only be created when its combined with the event action "Validation"

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...