Splunk Search

How to combine multiple time fields in order to create a full date for an event occurrence

asewell97
New Member

I currently have 3 different fields that contain parts of a date that must be put together to give a full time. I have day, hour and minute fields that are currently separate and need to be combined as I want to display the time an event occurred in a table.

1. Field 1 = day
2. Field 2 = hour
3. Field 3 = minute

I need it to be:

1. Field 1 = day:hour:minute

If someone could help with this it would be much appreciated.

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

HI asewell97,
are youspeking of search time or index time? in other words: did you already indexed data and you want to display date field or you want to index events setting the correct timestamp using the three fields?

If you're working at search time, it's easy, use eval command in your searches:

| eval my_date=field1." ".field2.":".field3

If instead you are speaking of index time, please share an example of your logs to create the correct TIME_FORMAT option.

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI asewell97,
are youspeking of search time or index time? in other words: did you already indexed data and you want to display date field or you want to index events setting the correct timestamp using the three fields?

If you're working at search time, it's easy, use eval command in your searches:

| eval my_date=field1." ".field2.":".field3

If instead you are speaking of index time, please share an example of your logs to create the correct TIME_FORMAT option.

Ciao.
Giuseppe

0 Karma

asewell97
New Member

Hi, the eval command was what I was looking for. I've got it all working now so thanks for the help.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use concatenation.

... | eval field=field1.":".field2.":"field3
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...