I have a number of tables in a Splunk report that looks like this:
_time Count 1 2018-01 3815
But when I want to schedule the report I send a Test Email (Export - Schedule PDF Delivery - Send Test Email)
The email comes through alright but the date format is changed to YYYY.(i.e. the month is lost e.g. changed from 2018-01 to 2018)
_time Count 1 2018 3815
*Is there something I can do to fix this so the date remains 2018-01? *
I have the same problem, I resolve by forcing my timestamp in the query with:
| convert timeformat="%m/%d/%Y"
strptime/strftime with eval.
... | eval _time = strftime(_time,"%Y-%m") at the end of my search even though its in the YYYY-MM format already in the dashboard.
But when I email the pdf, in the pdf the table disapperas and I get
year=1 is before 1900; the datetime strftime() methods require year >= 1900
I am not sure what this means?
my time range is a bit different but this just gives me the 31 day values of january which I then
timechart span=mon sum(Count) to get the monthly value
sry, the command was not completed, you will need:
| convert timeformat="%m/%d/%Y" ctime(_time) as _time
but i think will not gonna work.
sometimes you will need to create a new variable to use instead of _time
| eval date = strftime(_time,"%Y-%m")
to show correctly, you can use:
| sort _time
| table date Count
| convert timeformat="%m/%d/%Y" ctime(_time) as _time did not work
You get this
year=1 is before 1900; the datetime strftime() methods require year >= 1900 instead of the table. Which I dont understand. I guess that is just the way splunk is regarding pdf scheduling.
| eval date = strftime(_time,"%Y-%m") | sort _time | table date Count did work.
Basically the _time column is not liked in the tables in your dashboard when you try and pdf schedule it. So you basically have to remove the _time column and call it something else.
note: I thought you could just
rename _time as date but this will convert the date into a number, so you will then have to reformat this, which is just another way of doing the same as 2 above.
nice, i'm glad it works.
The _time real value is aways something like 1526324562.234, so somethime you will need to create a new variable.
In my country the date default is dd/mm/YYYY, so i aways need to re-adjust the _time.