Splunk Search

How to add a Date Field into my search and dashboard in Splunk Light?

dvadithala
New Member

Hi,

I'm completely new to Splunk and using Light version for evaluation. How can I add a date field into my search and also to the dashboard? I have Timestamp, date_mday, date_wday, date_hour etc.

But I wanted a date field for persistent field and also I wanted to use in my dashboard.

Please help.

Thanks,
Me

0 Karma

jedatt01
Builder

If I understand what you are asking correctly, try adding this to your query to create a date field with the time stripped off. It is derived from the _time field which is Splunk's internal representation of your event date/timestamp

| eval mytime=strftime(_time, "%Y%m%d")

Does that answer your question?

0 Karma

dvadithala
New Member

Thanks for replying back. I don't understand it. Sorry, it's me, as I'm beginner. Based on your response. I've added your expression as following under "Edit Search String" in the dashboard. But it doesn't show the dates.

Severity=Error | eval mytime=strftime(_time, "%Y%m%d")

How can I add Date field as a field, like Timestamp, date_mday etc?

Thanks again.
Me

0 Karma

jedatt01
Builder

when you use the eval command it will create a new field. In this case it's called mytime. You can use mytime just like you would use Timestamp or date_mday.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...