Splunk Search

rename command is changing time format

shakSplunk
Path Finder

Hi all,

I have a field that has a time value such as (_time field):

2021-08-12 15:18:42

However, when I got to use the rename command on the _time field, it changes the format to:

1628723833

Any assistance in how to NOT make the date format change whilst also renaming the field would be greatly appreciated.

Labels (1)
0 Karma
1 Solution

tscroggins
Influencer

@shakSplunk 

_time is an epoch value internally, but splunkweb provides default formatting for _time. That formatting is lost if you rename the field.

You can restore formatting in tables with fieldformat:

| rename _time as t
| fieldformat t=strftime(t, "%F %T")

If you want to treat t as a string, you can convert the value:

| eval t=strftime(t, "%F %T")

View solution in original post

tscroggins
Influencer

@shakSplunk 

_time is an epoch value internally, but splunkweb provides default formatting for _time. That formatting is lost if you rename the field.

You can restore formatting in tables with fieldformat:

| rename _time as t
| fieldformat t=strftime(t, "%F %T")

If you want to treat t as a string, you can convert the value:

| eval t=strftime(t, "%F %T")

shakSplunk
Path Finder

Hi @tscroggins 

Thanks for the answer! It works when the rename label is one word however when there are whitespaces, it doesn't seem to work. E.g.

| rename _time as "Latest Log Timestamp"
| fieldformat 'Latest Log Timestamp'=strftime(t, "%F %T")

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You left 't' in the strftime. Your statements should be

| fieldformat "Latest Log Timestamp"=strftime('Latest Log Timestamp', "%F %T")

i.e. double quotes on the left hand side and single quotes on the right hand side

 

Tags (1)

shakSplunk
Path Finder

Good spot, cheers

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...