Splunk Search

Is there a way to remove seconds from a table?

Explorer

I'm trying to create a report where it shows the date and time; however, when it comes to time I just want it to display the hour and minutes, not the seconds. Is there a way to do that?

Tags (4)
0 Karma
1 Solution

Communicator

@jrevolorio try adding this pipe into your search your search | eval time=strftime(_time, "%H:%M") | your report

What we are doing is taking the _time field and stripping out the Hour and Minute only. If you have another field you are pulling time from you can replace _time for that field. When you create your output you will then use the time field instead.

View solution in original post

SplunkTrust
SplunkTrust

You can format it, the way that @richgalloway and @Grumpalot said, or you can actually change the _time to eliminate the seconds like this -

| eval _time = 60*floor(_time/60)

Under the above, the standard output for _time should hide the seconds.

SplunkTrust
SplunkTrust

Use the fieldformat command. Something like this:

... | fieldformat myField=strftime(myField, "%Y-%m-%d %H:%M")
---
If this reply helps you, an upvote would be appreciated.
0 Karma

Communicator

@jrevolorio try adding this pipe into your search your search | eval time=strftime(_time, "%H:%M") | your report

What we are doing is taking the _time field and stripping out the Hour and Minute only. If you have another field you are pulling time from you can replace _time for that field. When you create your output you will then use the time field instead.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!