How to make the time readable in stats latest(_time)?

[yshen]

By the following query, I can list the hosts status and when they have their status change:

index=snmptrapd 
| table _time Agent_Hostname alertStatus_1

with this query the _time values are readable as for example, 

2020-08-19 21:07:50

However, when I only want to find the latest time when a host has a certain status, by the following query,

index=snmptrapd 
| stats latest(_time) by Agent_Hostname alertStatus_1

then 

Agent_Hostname alertStatus_1 latest(_time)

l18-tempmon	critical	1597896470
l20-tempmon	critical	1597901380
l20-tempmon	normal	1597891753

How can I make the field for latest(_time) still readable as before?

[altink]

can anyone advise on this ?

regards
Altin

[isoutamo · Accepted solution]

Hi

_time is some kind of special that it shows it's value "correctly" without any helps. On all other time fields which has value as unix epoch you must convert those to human readable form. One way to do it is 

index=snmptrapd 
| stats latest(_time)as latestTime by Agent_Hostname alertStatus_1
| eval latestTime = strftime(latestTime, "%F %T")

You could found more about working with time fields

• https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Commontimeformatvariables
• https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/DateandTimeFunctions 

r. Ismo

[altink]

Hi

I think I am doing the same thing, but it does not work for me

https://community.splunk.com/t5/Dashboards-Visualizations/strftime-empties-stats-ed-field/m-p/530449...

best
Altin