Hello Splunkers,
I have a question about data I am trying to draw from Splunk. If you look at the fields, I am am trying to do something like this.
Table
report_name, report_date, time
AReport 2016-07-08 1:00PM
BReport junkdatakdls;f 2:00PM
CReport morejunkkfkdsd 3:00PM
From the above, how can I ask Splunk to keep only the report_date multivalue field value (Type of YYYY-MM-DD)
I will like to leave the junk data out of that field, but do not want to restrict the count of rows either. So I would like to make any field that is not in a date format of YYYY-MM-DD just blank.
Thanks,
Daniel MacGillivray
... View more