Splunk Search

Stats - Why isn't Splunk converting _time to Human readable format

neerajs_81
Builder

Hello,
I have the below search

 

 

 <base search>..
|stats values(Source) as Source count min(_time) as firstTime max(_time) as lastTime by dest,Service_Name, Service_ID, Ticket_Encryption_Type, Ticket_Options
|convert timeformat="%F %H:%M:%S" ctime(values(lastTime))
|convert timeformat="%F %H:%M:%S" ctime(values(firstTime))

 

 


I got the above search from: https://docs.splunksecurityessentials.com/content-detail/kerberoasting_spn_request_with_rc4_encrypti...

Yet Splunk is not coverting the firstTime and LastTime values into human readable format. It continues to display in unix time. Please advise.

Results of Search:

neerajs_81_0-1652076510336.png

Note:  I also tried using eval before the stats command , but same thing   the firstTime and LastTime are still showing in unix format

| eval _time = strftime(_time, "%F %H:%M:%S")




 

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

values() is an aggregation function (used with stats command etc) not an evaluation function. Try it this way:

|convert timeformat="%F %H:%M:%S" ctime(lastTime)
|convert timeformat="%F %H:%M:%S" ctime(firstTime)
0 Karma

gcusello
Legend

Hi @neerajs_81,

you should try to use the eval function after the stats command:

<base search>
| stats values(Source) as Source count min(_time) as firstTime max(_time) as lastTime by dest,Service_Name, Service_ID, Ticket_Encryption_Type, Ticket_Options
| eval firstTime=strftime(firstTime,"%Y-%m-%d %H:%M:%S"), lastTime=strftime(lastTime,"%Y-%m-%d %H:%M:%S")

ciao.

Giuseppe

0 Karma

PickleRick
Ultra Champion

Even better - use fieldformat. That way the value itself is left as unix timestamp and is easy to manipulate, adjust, compare and so on but is displayed in a human-redable format.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...