Splunk Search

table export displays different date format

voltaireb
New Member

Hi All, If I create a custom report using a table, the date displays and outputs in the browser fine:
11/1/11 5:35:20.000 PM

However, when I export the custom report to CSV, the date does not display as the browser:
2011-11-01T17:35:20.000-05:00

Any idea how I can get the CSV date to appear like what's displayed in the browser?

0 Karma

obesechicken13
Explorer

I think this occurs when you create a time chart and export that data. I don't think you can add a field to a timechart just like that.
timechart count by domain,_time
returns _time not valid.

You can go to excel and convert the date manually.

So as an example you can use the datevalue or date functions in excel.
datevalue("2012-11-30")+B2/24
when 2012-11-30 is the first date of your splunk data
and your data has a span of an hour (24)
and column B in excel is a bunch of numbers starting from 0 and incrementing by 1 every row down.

0 Karma

DanielBC
Explorer

You can add an additional formatted time field to your query to format the date/time into something a little easier to read with: '| convert ctime(_time) as time'

When you export the data you can remove the _time field from the CSV and use the new 'time' field instead.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How to Break a Kubernetes Pod on Purpose and Let the AI Troubleshooting Agent Find ...

Let's say I've just rolled out a Kubernetes Deployment with a typo in the image tag. Nothing explodes. The pod ...

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

The updated Splunk Add-on for Microsoft Windows helps customers search Windows events faster by reducing ...

What's New in Splunk Enterprise Security 8.8 and Beyond

Threats move at machine speed. Keeping up should not depend on having the biggest budget, the largest team, or ...