Splunk Search

fieldformat not working?

bojanz
Communicator

I'm using fieldformat (Splunk 5.0.5, search head in a cluster, if that matters) in order to change how the time is displayed and to preserve proper sorting in tables, however it appears that it does not work correctly at all (sorting still fails).

Here's what I'm doing:

index=windows source="wineventlog:security" "EventCode=644" OR "EventCode=4740" | fieldformat Time=strftime(_time, "%d.%m.%Y %H:%M:%S") | table _time Time host Account_Name

This displays a table that uses both the original _time and Time. The Time variable is properly displayed but sorting by it fails.

If I do this:

index=windows source="wineventlog:security" "EventCode=644" OR "EventCode=4740" | fieldformat _time=strftime(_time, "%d.%m.%Y %H:%M:%S") | table _time host Account_Name

Then time is completely lost and all entries show as 1/1/01 12:00:00.000 AM.

Any clues?

Tags (3)
0 Karma

lguinn2
Legend

fieldformat creates a representation (usually a string) for a field that is independent of its underlying value. The _time field is an internal field, and it cannot have such a representation.

Your first search gives you a representation for Time but not an underlying value that is sortable; it is simply a string. That is why it doesn't sort properly.

Your second search attempts to assign a string representation to the internal variable _time; this doesn't work.

To get what you want, try

index=windows source="wineventlog:security" EventCode=644 OR EventCode=4740 
| eval Time=_time
| fieldformat Time=strftime(Time, "%d.%m.%Y %H:%M:%S") 
| table Time host Account_Name
0 Karma

linu1988
Champion

index=windows source="wineventlog:security" "EventCode=644" OR "EventCode=4740" | eval Time=strftime(_time, "%d.%m.%Y %H:%M:%S")|fields - _time| sort + Time | table Time host Account_Name

Works in Splunk 6, not sure where the sorting fails!

0 Karma

lguinn2
Legend

Sorry, there was a typo in my answer. I then tested this on my Splunk and it works.

0 Karma

bojanz
Communicator

Nope, this still doesn't work for me. The Time field is empty (no content at all).
If I put fieldformat Time=strftime(_time ...) then sorting doesn't work.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...