Splunk Search

How to combine multiple time fields in order to create a full date for an event occurrence

asewell97
New Member

I currently have 3 different fields that contain parts of a date that must be put together to give a full time. I have day, hour and minute fields that are currently separate and need to be combined as I want to display the time an event occurred in a table.

1. Field 1 = day
2. Field 2 = hour
3. Field 3 = minute

I need it to be:

1. Field 1 = day:hour:minute

If someone could help with this it would be much appreciated.

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

HI asewell97,
are youspeking of search time or index time? in other words: did you already indexed data and you want to display date field or you want to index events setting the correct timestamp using the three fields?

If you're working at search time, it's easy, use eval command in your searches:

| eval my_date=field1." ".field2.":".field3

If instead you are speaking of index time, please share an example of your logs to create the correct TIME_FORMAT option.

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI asewell97,
are youspeking of search time or index time? in other words: did you already indexed data and you want to display date field or you want to index events setting the correct timestamp using the three fields?

If you're working at search time, it's easy, use eval command in your searches:

| eval my_date=field1." ".field2.":".field3

If instead you are speaking of index time, please share an example of your logs to create the correct TIME_FORMAT option.

Ciao.
Giuseppe

0 Karma

asewell97
New Member

Hi, the eval command was what I was looking for. I've got it all working now so thanks for the help.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use concatenation.

... | eval field=field1.":".field2.":"field3
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...