Splunk Search

rename command is changing time format

shakSplunk
Path Finder

Hi all,

I have a field that has a time value such as (_time field):

2021-08-12 15:18:42

However, when I got to use the rename command on the _time field, it changes the format to:

1628723833

Any assistance in how to NOT make the date format change whilst also renaming the field would be greatly appreciated.

Labels (1)
0 Karma
1 Solution

tscroggins
Influencer

@shakSplunk 

_time is an epoch value internally, but splunkweb provides default formatting for _time. That formatting is lost if you rename the field.

You can restore formatting in tables with fieldformat:

| rename _time as t
| fieldformat t=strftime(t, "%F %T")

If you want to treat t as a string, you can convert the value:

| eval t=strftime(t, "%F %T")

View solution in original post

tscroggins
Influencer

@shakSplunk 

_time is an epoch value internally, but splunkweb provides default formatting for _time. That formatting is lost if you rename the field.

You can restore formatting in tables with fieldformat:

| rename _time as t
| fieldformat t=strftime(t, "%F %T")

If you want to treat t as a string, you can convert the value:

| eval t=strftime(t, "%F %T")

shakSplunk
Path Finder

Hi @tscroggins 

Thanks for the answer! It works when the rename label is one word however when there are whitespaces, it doesn't seem to work. E.g.

| rename _time as "Latest Log Timestamp"
| fieldformat 'Latest Log Timestamp'=strftime(t, "%F %T")

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You left 't' in the strftime. Your statements should be

| fieldformat "Latest Log Timestamp"=strftime('Latest Log Timestamp', "%F %T")

i.e. double quotes on the left hand side and single quotes on the right hand side

 

Tags (1)

shakSplunk
Path Finder

Good spot, cheers

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...