Splunk Search

How to change the _time text in the table?

renanprado96
Path Finder

How to change the _time text in the table?

How to change in _time of "2016-04-01" to "first week", for example.

alt text

Thank You

1 Solution

woodcock
Esteemed Legend

Just add this:

| fieldformat _time = "week " . strftime(_time, "%U")

View solution in original post

woodcock
Esteemed Legend

Just add this:

| fieldformat _time = "week " . strftime(_time, "%U")

renanprado96
Path Finder

Its Possible to change the week number for the month?
Of 1-5?

Days 1-7 - week 1
Days 8-14 - week 2
Days 15-21 - week 3
Days 22-28 - week 4 
Days 29-31 - week 5
0 Karma

ddrillic
Ultra Champion

strftime

doesn't have such an option, only the week of the year...

0 Karma

woodcock
Esteemed Legend

Like this:

| fieldformat _time = case((tonumber(strftime(_time, "%d")) <= 7),  "1",
                           (tonumber(strftime(_time, "%d")) <= 14), "2",
                           (tonumber(strftime(_time, "%d")) <= 21), "3",
                           (tonumber(strftime(_time, "%d")) <= 28), "4",
                                                            true(), "5")
0 Karma

renanprado96
Path Finder

Thank you!!!
Have a good day..

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...