Splunk Search

Eval Expression in Data Model

ebs
Communicator

Hi,

I'm trying to create an eval expression in my data model which is based on _time. Can you please advise on what I'm doing wrong?

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

My bad just put <<YOUR_CODE>> and try

 

strftime(_time,"%Y-%m-%d")

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

remove | eval from eval block. just date=<<YOUR_CODE>>

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

My bad just put <<YOUR_CODE>> and try

 

strftime(_time,"%Y-%m-%d")

0 Karma

ebs
Communicator

I get this error

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...