Splunk Search

Need help in some time conversion

Path Finder

HI all,

Need help in getting below code adjust to get the value as expected.

index=nw_syslog "DDOS_PROTOCOL_VIOLATION_SET" AND ( "*USDAL*" OR "*USEMC*" OR "*NLACO*" OR "*SGPNH*" OR "*USHCO*" OR "*INMCO*" OR "*CACCO*" OR "*CATRC*" OR "*GBLHD*") ARP
 | stats  latest(_time) as Time_CST count by hostname
  | sort - Time_CST
 | fieldformat Time_CST=strftime(Time_CST,"%x %X")

Current Output

hostname    Time_CST    count
USEMCPOD07-DCNPS3003    02/28/20 06:41:37   3
USEMCPOD07-DCNPS3001    02/28/20 06:41:36   3
USEMCPOD07-DCNPS3002    02/28/20 06:41:36   3
USEMCPOD07-DCNPS3004    02/28/20 06:41:36   2

Expected output.: minus the second.

hostname    Time_CST    count
USEMCPOD07-DCNPS3003    02/28/20 06:41  3
USEMCPOD07-DCNPS3001    02/28/20 06:41  3
USEMCPOD07-DCNPS3002    02/28/20 06:41  3
USEMCPOD07-DCNPS3004    02/28/20 06:41  2
0 Karma
1 Solution

Ultra Champion

Hi @jerinvarghese

Use:
strftime(Time_CST,"%m/%d/%y %H:%M")

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

Ultra Champion

Hi @jerinvarghese

Use:
strftime(Time_CST,"%m/%d/%y %H:%M")

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

Path Finder

thanks so much, that worked..

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!