Splunk Search

Epoch Date format in reporting


Hi ,

i have 2 queries .

(index=abc OR index=def) category= * OR NOT blocked =0 AND NOT blocked =2
|rex field=index "(?<Local_Market>[^cita]\w.*?)_"
| stats count(Local_Market) as Blocked by Local_Market
| addcoltotals col=t labelfield=Local_Market label="Total"
| append [search (index=abc  OR index=def) blocked =0 | rex field=index "(?<Local_Market>\w.*?)_"
| stats count as Detected by Local_Market
| addcoltotals col=t labelfield=Local_Market label="Total"]
| stats values(*) as * by Local_Market
| transpose 0 header_field=Local_Market column_name=Local_Market | addinfo
| eval date=info_min_time
| fieldformat date=strftime(date,"%m-%d-%Y")
| fields - info_*

1> above query is giving me the correct date time ..but when i am scheduling this as report its coming  as Epoch time in csv file ..

2>  also how can we get date field in first column instead of last column without disturbing the other fields ..

thanks in advance

Labels (1)
Tags (1)
0 Karma


1> Use eval rather than fieldformat to have the format preserved in the CSV.

2> Use the table command to specify the order of fields.

If this reply helps you, Karma would be appreciated.
0 Karma


@richgalloway  table command wont work here i  believe .. as we are already using stats command ..please correct me if i am wrong ..


0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...