Splunk Search

Eval Expression in Data Model

ebs
Communicator

Hi,

I'm trying to create an eval expression in my data model which is based on _time. Can you please advise on what I'm doing wrong?

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

My bad just put <<YOUR_CODE>> and try

 

strftime(_time,"%Y-%m-%d")

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

remove | eval from eval block. just date=<<YOUR_CODE>>

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

My bad just put <<YOUR_CODE>> and try

 

strftime(_time,"%Y-%m-%d")

0 Karma

ebs
Communicator

I get this error

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...