Splunk Search

How to change the _time text in the table?

Path Finder

How to change the _time text in the table?

How to change in _time of "2016-04-01" to "first week", for example.

alt text

Thank You

1 Solution

Esteemed Legend

Just add this:

| fieldformat _time = "week " . strftime(_time, "%U")

View solution in original post

Esteemed Legend

Just add this:

| fieldformat _time = "week " . strftime(_time, "%U")

View solution in original post

Path Finder

Its Possible to change the week number for the month?
Of 1-5?

Days 1-7 - week 1
Days 8-14 - week 2
Days 15-21 - week 3
Days 22-28 - week 4 
Days 29-31 - week 5
0 Karma

Ultra Champion

strftime

doesn't have such an option, only the week of the year...

0 Karma

Esteemed Legend

Like this:

| fieldformat _time = case((tonumber(strftime(_time, "%d")) <= 7),  "1",
                           (tonumber(strftime(_time, "%d")) <= 14), "2",
                           (tonumber(strftime(_time, "%d")) <= 21), "3",
                           (tonumber(strftime(_time, "%d")) <= 28), "4",
                                                            true(), "5")
0 Karma

Path Finder

Thank you!!!
Have a good day..

0 Karma