Splunk Search

Epoch Date format in reporting

Susha
Engager

Hi ,

i have 2 queries .

(index=abc OR index=def) category= * OR NOT blocked =0 AND NOT blocked =2
|rex field=index "(?<Local_Market>[^cita]\w.*?)_"
| stats count(Local_Market) as Blocked by Local_Market
| addcoltotals col=t labelfield=Local_Market label="Total"
| append [search (index=abc  OR index=def) blocked =0 | rex field=index "(?<Local_Market>\w.*?)_"
| stats count as Detected by Local_Market
| addcoltotals col=t labelfield=Local_Market label="Total"]
| stats values(*) as * by Local_Market
| transpose 0 header_field=Local_Market column_name=Local_Market | addinfo
| eval date=info_min_time
| fieldformat date=strftime(date,"%m-%d-%Y")
| fields - info_*

1> above query is giving me the correct date time ..but when i am scheduling this as report its coming  as Epoch time in csv file ..

2>  also how can we get date field in first column instead of last column without disturbing the other fields ..

thanks in advance

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

1> Use eval rather than fieldformat to have the format preserved in the CSV.

2> Use the table command to specify the order of fields.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Susha
Engager

@richgalloway  table command wont work here i  believe .. as we are already using stats command ..please correct me if i am wrong ..

 

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...