Splunk Search

fieldformat not working?

bojanz
Communicator

I'm using fieldformat (Splunk 5.0.5, search head in a cluster, if that matters) in order to change how the time is displayed and to preserve proper sorting in tables, however it appears that it does not work correctly at all (sorting still fails).

Here's what I'm doing:

index=windows source="wineventlog:security" "EventCode=644" OR "EventCode=4740" | fieldformat Time=strftime(_time, "%d.%m.%Y %H:%M:%S") | table _time Time host Account_Name

This displays a table that uses both the original _time and Time. The Time variable is properly displayed but sorting by it fails.

If I do this:

index=windows source="wineventlog:security" "EventCode=644" OR "EventCode=4740" | fieldformat _time=strftime(_time, "%d.%m.%Y %H:%M:%S") | table _time host Account_Name

Then time is completely lost and all entries show as 1/1/01 12:00:00.000 AM.

Any clues?

Tags (3)
0 Karma

lguinn2
Legend

fieldformat creates a representation (usually a string) for a field that is independent of its underlying value. The _time field is an internal field, and it cannot have such a representation.

Your first search gives you a representation for Time but not an underlying value that is sortable; it is simply a string. That is why it doesn't sort properly.

Your second search attempts to assign a string representation to the internal variable _time; this doesn't work.

To get what you want, try

index=windows source="wineventlog:security" EventCode=644 OR EventCode=4740 
| eval Time=_time
| fieldformat Time=strftime(Time, "%d.%m.%Y %H:%M:%S") 
| table Time host Account_Name
0 Karma

linu1988
Champion

index=windows source="wineventlog:security" "EventCode=644" OR "EventCode=4740" | eval Time=strftime(_time, "%d.%m.%Y %H:%M:%S")|fields - _time| sort + Time | table Time host Account_Name

Works in Splunk 6, not sure where the sorting fails!

0 Karma

lguinn2
Legend

Sorry, there was a typo in my answer. I then tested this on my Splunk and it works.

0 Karma

bojanz
Communicator

Nope, this still doesn't work for me. The Time field is empty (no content at all).
If I put fieldformat Time=strftime(_time ...) then sorting doesn't work.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...