By the following query, I can list the hosts status and when they have their status change:
index=snmptrapd
| table _time Agent_Hostname alertStatus_1
with this query the _time values are readable as for example,
2020-08-19 21:07:50
However, when I only want to find the latest time when a host has a certain status, by the following query,
index=snmptrapd
| stats latest(_time) by Agent_Hostname alertStatus_1
then
Agent_Hostname alertStatus_1 latest(_time)
l18-tempmon | critical | 1597896470 |
l20-tempmon | critical | 1597901380 |
l20-tempmon | normal | 1597891753 |
How can I make the field for latest(_time) still readable as before?
Hi
_time is some kind of special that it shows it's value "correctly" without any helps. On all other time fields which has value as unix epoch you must convert those to human readable form. One way to do it is
index=snmptrapd
| stats latest(_time)as latestTime by Agent_Hostname alertStatus_1
| eval latestTime = strftime(latestTime, "%F %T")
You could found more about working with time fields
r. Ismo
can anyone advise on this ?
regards
Altin
Hi
_time is some kind of special that it shows it's value "correctly" without any helps. On all other time fields which has value as unix epoch you must convert those to human readable form. One way to do it is
index=snmptrapd
| stats latest(_time)as latestTime by Agent_Hostname alertStatus_1
| eval latestTime = strftime(latestTime, "%F %T")
You could found more about working with time fields
r. Ismo
Hi
I think I am doing the same thing, but it does not work for me