Solved: How to make a string date UI sortable like _time?

nick405060 · ‎10-29-2019

I have a string date field and would like to sort it in a table by clicking the field.

No, I do not want it displayed as epoch.

How can I do this?

nick405060 · ‎10-29-2019

fieldformat:

| makeresults | eval a="11/4/2018" | append [| makeresults | eval a ="1/5/2019"] | sort 0 a | eval a=strptime(a,"%m/%d/%Y") | fieldformat a=strftime(a,"%m/%d/%Y") | table a

View solution in original post

nick405060 · ‎10-29-2019

fieldformat:

| makeresults | eval a="11/4/2018" | append [| makeresults | eval a ="1/5/2019"] | sort 0 a | eval a=strptime(a,"%m/%d/%Y") | fieldformat a=strftime(a,"%m/%d/%Y") | table a

How to make a string date UI sortable like _time?

Developer Spotlight with Brett Adams

Index This | What can you do to make 55,555 equal 500?

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...