Splunk Search

help on date field sorting

jip31
Motivator

hi

the field dv_sys_created_on is a field date

index="tutu" sourcetype="toto" 
| stats last(dv_sys_created_on) as Opened by ticket_id 

i tried to sort it like this but it doesnt works

| eval time = strftime(dv_sys_created_on, "%d-%m-%y %H:%M")
| sort - dv_sys_created_on

could you help please??

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @jip31,

You are loosing the dv_sys_created_on field on stats command, you can sort like below;

index="tutu" sourcetype="toto" 
| stats last(dv_sys_created_on) as Opened by ticket_id 
| sort - Opened

Or if date field is string below should work better; assuming your date format is "%d-%m-%y %H:%M"

index="tutu" sourcetype="toto" 
| stats last(dv_sys_created_on) as Opened by ticket_id 
| eval time = strptime(Opened, "%d-%m-%y %H:%M")
| sort - time

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What does "the field dv_sys_created_on is a field date" mean? Is it a string in a particular format representing a date? If so, you need to parse the string (the p in strptime means parse, the f in strftime means format) into an epoch datetime (a number) which you can then sort on (strptime, string to number; strftime, number to string)

| eval time = strptime(dv_sys_created_on, "%d-%m-%y %H:%M")
| sort - time

 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @jip31,

You are loosing the dv_sys_created_on field on stats command, you can sort like below;

index="tutu" sourcetype="toto" 
| stats last(dv_sys_created_on) as Opened by ticket_id 
| sort - Opened

Or if date field is string below should work better; assuming your date format is "%d-%m-%y %H:%M"

index="tutu" sourcetype="toto" 
| stats last(dv_sys_created_on) as Opened by ticket_id 
| eval time = strptime(Opened, "%d-%m-%y %H:%M")
| sort - time

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...