Eval expression with gentimes is not generating new fileds

[jagadeeshm]

Here is my SPL -

| gentimes start=02/07/2017 end=02/08/2017 increment=1h 
| convert timeformat="%Y-%m-%d %H:%M:%S" ctime(starttime) as _time 
| fields _time 
| eval HourOfDay=strftime(_time, "%H") 
| eval BucketMinuteOfHour=strftime(_time, "%M")

Why is this not generating HourOfDay and BucketMinuteOfHour fields in the results?

Thanks!

[kamlesh_vaghela · Accepted solution]

HI @jagadeeshm,

Can you please try below two searches?

I don't know why you format the time but below is working for me. Only value of increment parameter is different. Please check it nad see the difference.

| gentimes start=02/07/2017 end=02/08/2017 increment=1m 
 | rename starttime as _time 
 | fields _time 
 | eval HourOfDay=strftime(_time, "%H") 
 | eval BucketMinuteOfHour=strftime(_time, "%M")

AND

| gentimes start=02/07/2017 end=02/08/2017 increment=1s 
 | rename starttime as _time 
 | fields _time 
 | eval HourOfDay=strftime(_time, "%H") 
 | eval BucketMinuteOfHour=strftime(_time, "%M")

Thanks

[jagadeeshm]

Thanks! It works for most part, but I don't see the seconds in the time.

[jagadeeshm]

Ok, If I use ctime later it works -

| gentimes start=02/07/2017 end=02/08/2017 increment=1h 
| rename starttime as _time
 | fields _time 
 | eval HourOfDay=strftime(_time, "%H") 
 | eval BucketMinuteOfHour=strftime(_time, "%M")
 | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) as _time 

Intersting!

[kamlesh_vaghela]

Yeah..
Your issue resolved?