I have time field which have values such as 9AM-10PM, 10:00AM-11:00PM, I want to change 9AM-10PM to 9:00AM-10:00 PM, to normalize field in sameformat. I tired strftime(strptime(time_field,"%H%p-%H...
In the query _time is already formatted. But when i try to export the data in csv its showing different formats.
Query:index="wineventlog" host IN (USMDCKPAP30074) EventCode=6...
Hello Splunk Community, I am trying to replicate a heat map using the table formats app available through Splunk. I see the coloring of the cells when I use the stats command as b...
Hello, What would be my TIME_FORMAT for prop configuration file for this events 2021-06-08T13:26:53.665000-04:00|PGM|mtb1120ppcdwap6|vggtb|26462| 2021-06-08T13:26:54.478000-04:00|PGM|mtb1120ppcdwa...
Our data input contains two timestamp fields — creation_time and modification_time — both formatted in line with ISO 8601 (yyyy/mm/dd hh:mm:ss.ms). Splunk parses modification_time as _...
I have a timestamp like this "2020-Jan-01 21:59" When I ingest data, I want this timestamp field to be registered as _time field in splunk What is the right striptime() string to use to parse ...
Hi I have two date fields that show up in my dash board panel that lists events after visualisation panels. "2021-11-02 16:53:38" and "11/02/21 at 16:52:37" I am trying to find a way to reformat th...
I want to extract the field that are on the left which are status, monitoirng status, monitoring mode and so on. Multikv command can be used when the header is at the first row. What command should I...