Splunk Search

How to make a string date UI sortable like _time?

nick405060
Motivator

I have a string date field and would like to sort it in a table by clicking the field.

No, I do not want it displayed as epoch.

How can I do this?

0 Karma
1 Solution

nick405060
Motivator

fieldformat:

| makeresults | eval a="11/4/2018" | append [| makeresults | eval a ="1/5/2019"] | sort 0 a | eval a=strptime(a,"%m/%d/%Y") | fieldformat a=strftime(a,"%m/%d/%Y") | table a

View solution in original post

0 Karma

nick405060
Motivator

fieldformat:

| makeresults | eval a="11/4/2018" | append [| makeresults | eval a ="1/5/2019"] | sort 0 a | eval a=strptime(a,"%m/%d/%Y") | fieldformat a=strftime(a,"%m/%d/%Y") | table a
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...