Splunk Search

fieldformat command giving error

sscandoit
Explorer

Hi,

I am using Splunk 4.1.2. I am trying to use fieldformat to format the _time to avoid converting it to string. Following is my search string:

index="someindex" sourcetype="log" | fieldformat mytime=strftime(_time,"%m/%d/%Y %k:%M") | table mytime, account_id

However I am getting the following error:

Search operation 'fieldformat' is
unknown. You might not have permission
to run this operation.

I think I am missing something here. Appreciate all the help I have got on this forum.

Thanks,
Suvelee

Lowell
Super Champion

The fieldformat search command isn't supported until Splunk 4.2.

0 Karma

bbingham
Builder

use "convert", try this:

index="someindex" sourcetype="log" | convert timeformat="%m/%d/%Y %k:%M" ctime(_time) AS mytime |table mytime, account_id

the function "ctime" is for converting epoch time to ascii. Hope it helps!

0 Karma

sscandoit
Explorer

For some reason, I didn't get an email for this comment. I tried | eval start_time=_time|fieldformat start_time = strftime(start_time,"%m/%d/%Y %k:%M") but this didn't work either. Its giving the same error. Thanks a lot.

I can use "sort" to order the results but that will do it one time. I wanted to let the user sort the results using up/down arrows provided by the simpleResultsTable.

0 Karma

bbingham
Builder

You can also pipe to "sort" to order it how you'd like, but try this:

| eval start_time=_time|fieldformat start_time = strftime(start_time,"%m/%d/%Y %k:%M")

0 Karma

sscandoit
Explorer

Thanks for the reply. I had used convert before. But it doesn't sort the timestamp in the results table. So to preserve the timestamp I tried using fieldformat.

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...