Hi,
I am using Splunk 4.1.2. I am trying to use fieldformat to format the _time to avoid converting it to string. Following is my search string:
index="someindex" sourcetype="log" | fieldformat mytime=strftime(_time,"%m/%d/%Y %k:%M") | table mytime, account_id
However I am getting the following error:
Search operation 'fieldformat' is
unknown. You might not have permission
to run this operation.
I think I am missing something here. Appreciate all the help I have got on this forum.
Thanks,
Suvelee
The fieldformat
search command isn't supported until Splunk 4.2.
use "convert", try this:
index="someindex" sourcetype="log" | convert timeformat="%m/%d/%Y %k:%M" ctime(_time) AS mytime |table mytime, account_id
the function "ctime" is for converting epoch time to ascii. Hope it helps!
For some reason, I didn't get an email for this comment. I tried | eval start_time=_time|fieldformat start_time = strftime(start_time,"%m/%d/%Y %k:%M") but this didn't work either. Its giving the same error. Thanks a lot.
I can use "sort" to order the results but that will do it one time. I wanted to let the user sort the results using up/down arrows provided by the simpleResultsTable.
You can also pipe to "sort" to order it how you'd like, but try this:
| eval start_time=_time|fieldformat start_time = strftime(start_time,"%m/%d/%Y %k:%M")
Thanks for the reply. I had used convert before. But it doesn't sort the timestamp in the results table. So to preserve the timestamp I tried using fieldformat.