Splunk Search

Eval Expression in Data Model

ebs
Communicator

Hi,

I'm trying to create an eval expression in my data model which is based on _time. Can you please advise on what I'm doing wrong?

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

My bad just put <<YOUR_CODE>> and try

 

strftime(_time,"%Y-%m-%d")

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

remove | eval from eval block. just date=<<YOUR_CODE>>

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

My bad just put <<YOUR_CODE>> and try

 

strftime(_time,"%Y-%m-%d")

0 Karma

ebs
Communicator

I get this error

0 Karma
Get Updates on the Splunk Community!

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...