Splunk Search

How to change the _time text in the table?

renanprado96
Path Finder

How to change the _time text in the table?

How to change in _time of "2016-04-01" to "first week", for example.

alt text

Thank You

1 Solution

woodcock
Esteemed Legend

Just add this:

| fieldformat _time = "week " . strftime(_time, "%U")

View solution in original post

woodcock
Esteemed Legend

Just add this:

| fieldformat _time = "week " . strftime(_time, "%U")

renanprado96
Path Finder

Its Possible to change the week number for the month?
Of 1-5?

Days 1-7 - week 1
Days 8-14 - week 2
Days 15-21 - week 3
Days 22-28 - week 4 
Days 29-31 - week 5
0 Karma

ddrillic
Ultra Champion

strftime

doesn't have such an option, only the week of the year...

0 Karma

woodcock
Esteemed Legend

Like this:

| fieldformat _time = case((tonumber(strftime(_time, "%d")) <= 7),  "1",
                           (tonumber(strftime(_time, "%d")) <= 14), "2",
                           (tonumber(strftime(_time, "%d")) <= 21), "3",
                           (tonumber(strftime(_time, "%d")) <= 28), "4",
                                                            true(), "5")
0 Karma

renanprado96
Path Finder

Thank you!!!
Have a good day..

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...