I have following record in my log -
2019-06-13 10:59:56,664 INFO [FileUploadWebScript] [http-apr-8983-exec-5] The Upload Service /filenet/service/temp/upload succeeded in 2.366000 seconds, Request: {account=0063, creator=Test, name=Itinerary}
I need a report showing a tabular report with following columns -
Name | Account | creator | uploaded On
Itinerary .... 0063..... Test...... 2019-06-13
"Upload On" should be from the start of the line i.e., "2019-06-13 10:59:56,664"
I am able to get all other columns except date/time by this query -
...| stats list(name) as "Name", list(account) as "Account", list(creator) as "Creator"
How to change this statement so that I can get "Uploaded On" too?
Thanks!
Try this:
... | eval uploaded_On = strftime(_time, "%Y-%m-%d %H:%M:%S")
| table Uploaded_On name account creator
| rename name AS Name account AS Account create AS Creator
Try this:
... | eval uploaded_On = strftime(_time, "%Y-%m-%d %H:%M:%S")
| table Uploaded_On name account creator
| rename name AS Name account AS Account create AS Creator
Thanks Woodcock, it worked.
Hello Woodcock, somehow I am seeing some rows with Timestamp (Uploaded_ON) but no details around name, account & creator.
What we can do to make sure it shows record only if "name" is present?
Thanks!
Sure, just add | where isnotnull(name)
@runiyal - You can use eval "Uploaded On"=_time in the query to display "2019-06-13 10:59:56,664". If you want to show only Date, Use eval "Uploaded On"=strftime(_time, "%Y-%m-%d") in the query.
@runiyal- Is this the value of _time ?
Vijeta, this is the time of the log entry....I may just need to show "2019-06-13" under "Uploaded On" column.