Hi
I use a | stats min(_time) as time_min stats max(_time) as time_max command in my search
The time is displayed in Unix format
Example :
Time_min=1688019886.761
Time-max=1690461727.136
I have added an eval time=strftime(_time, "%d-%m-%Y %H:%M" before the stats in order to convert the time but the result is sometimes strange because the max time is older than the min time
How to convert the time properly please?
You need your search above and it needs to contain the _time field. Can you post your full SPL search?
<your search>
| stats min(_time) as time_min max(_time) as time_max
| convert ctime(time_min)
| convert ctime(time_max)
This should work with all Splunk installation:
index=_internal
| stats min(_time) as time_min max(_time) as time_max
| convert ctime(time_min)
| convert ctime(time_max)
If you like a custom format, yes, then your need to use eval and not convert.
PS if you can accept the answer it would be fine 🙂
You need your search above and it needs to contain the _time field. Can you post your full SPL search?
<your search>
| stats min(_time) as time_min max(_time) as time_max
| convert ctime(time_min)
| convert ctime(time_max)
This should work with all Splunk installation:
index=_internal
| stats min(_time) as time_min max(_time) as time_max
| convert ctime(time_min)
| convert ctime(time_max)
Try this:
| stats min(_time) as time_min max(_time) as time_max
| convert ctime(time_min)
| convert ctime(time_max)
Tha.ks it works
And now if i want to format the time i need to do an eval _time?