Splunk Search

Eval Expression in Data Model

ebs
Communicator

Hi,

I'm trying to create an eval expression in my data model which is based on _time. Can you please advise on what I'm doing wrong?

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

My bad just put <<YOUR_CODE>> and try

 

strftime(_time,"%Y-%m-%d")

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

remove | eval from eval block. just date=<<YOUR_CODE>>

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

My bad just put <<YOUR_CODE>> and try

 

strftime(_time,"%Y-%m-%d")

0 Karma

ebs
Communicator

I get this error

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...