Splunk Search

Eval expression with gentimes is not generating new fileds

jagadeeshm
Contributor

Here is my SPL -

| gentimes start=02/07/2017 end=02/08/2017 increment=1h 
| convert timeformat="%Y-%m-%d %H:%M:%S" ctime(starttime) as _time 
| fields _time 
| eval HourOfDay=strftime(_time, "%H") 
| eval BucketMinuteOfHour=strftime(_time, "%M")

Why is this not generating HourOfDay and BucketMinuteOfHour fields in the results?

Thanks!

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI @jagadeeshm,

Can you please try below two searches?

I don't know why you format the time but below is working for me. Only value of increment parameter is different. Please check it nad see the difference.

| gentimes start=02/07/2017 end=02/08/2017 increment=1m 
 | rename starttime as _time 
 | fields _time 
 | eval HourOfDay=strftime(_time, "%H") 
 | eval BucketMinuteOfHour=strftime(_time, "%M")

AND

| gentimes start=02/07/2017 end=02/08/2017 increment=1s 
 | rename starttime as _time 
 | fields _time 
 | eval HourOfDay=strftime(_time, "%H") 
 | eval BucketMinuteOfHour=strftime(_time, "%M")

Thanks

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI @jagadeeshm,

Can you please try below two searches?

I don't know why you format the time but below is working for me. Only value of increment parameter is different. Please check it nad see the difference.

| gentimes start=02/07/2017 end=02/08/2017 increment=1m 
 | rename starttime as _time 
 | fields _time 
 | eval HourOfDay=strftime(_time, "%H") 
 | eval BucketMinuteOfHour=strftime(_time, "%M")

AND

| gentimes start=02/07/2017 end=02/08/2017 increment=1s 
 | rename starttime as _time 
 | fields _time 
 | eval HourOfDay=strftime(_time, "%H") 
 | eval BucketMinuteOfHour=strftime(_time, "%M")

Thanks

jagadeeshm
Contributor

Thanks! It works for most part, but I don't see the seconds in the time.

0 Karma

jagadeeshm
Contributor

Ok, If I use ctime later it works -

| gentimes start=02/07/2017 end=02/08/2017 increment=1h 
| rename starttime as _time
 | fields _time 
 | eval HourOfDay=strftime(_time, "%H") 
 | eval BucketMinuteOfHour=strftime(_time, "%M")
 | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) as _time 

Intersting!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Yeah..
Your issue resolved?

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...