fieldformat command giving error

[sscandoit]

Hi,

I am using Splunk 4.1.2. I am trying to use fieldformat to format the _time to avoid converting it to string. Following is my search string:

index="someindex" sourcetype="log" | fieldformat mytime=strftime(_time,"%m/%d/%Y %k:%M") | table mytime, account_id

However I am getting the following error:

Search operation 'fieldformat' is
unknown. You might not have permission
to run this operation.

I think I am missing something here. Appreciate all the help I have got on this forum.

Thanks,
Suvelee

[Lowell]

The fieldformat search command isn't supported until Splunk 4.2.

[bbingham]

use "convert", try this:

index="someindex" sourcetype="log" | convert timeformat="%m/%d/%Y %k:%M" ctime(_time) AS mytime |table mytime, account_id

the function "ctime" is for converting epoch time to ascii. Hope it helps!

[sscandoit]

For some reason, I didn't get an email for this comment. I tried | eval start_time=_time|fieldformat start_time = strftime(start_time,"%m/%d/%Y %k:%M") but this didn't work either. Its giving the same error. Thanks a lot.

I can use "sort" to order the results but that will do it one time. I wanted to let the user sort the results using up/down arrows provided by the simpleResultsTable.

[bbingham]

You can also pipe to "sort" to order it how you'd like, but try this:

| eval start_time=_time|fieldformat start_time = strftime(start_time,"%m/%d/%Y %k:%M")

[sscandoit]

Thanks for the reply. I had used convert before. But it doesn't sort the timestamp in the results table. So to preserve the timestamp I tried using fieldformat.