About mrpaul

ITWhisperer · ‎01-05-2024

This is really an Excel question rather than a Splunk question. In Splunk, date-times are stored internally as the number of seconds since 1/1/1970, whereas in Excel, date-times are stored internally as the number of days since 1/1/1900 (I think). Just format the cell as a date in Excel.

woodcock · ‎03-04-2016

Let's assume you have a field called status that has (at least) values like start and end ; then you can use streamstats like this: ... | streamstats count earliest(_time) AS startTime latest(_time) AS endTime latest(status) AS lastStatus | count(eval(status="start")) AS sessionID | stats values(*) AS * BY sessionID

jcoates_splunk · ‎04-07-2014

hi, yes, this is an interesting use case, it's one of the features of the commercial Splunk App for Enterprise Security. A couple of links: http://docs.splunk.com/Documentation/ES/3.0.1/User/Notableeventsandincidentworkflow http://docs.splunk.com/Documentation/ES/3.0.1/User/NotableEvents

Posts	5
Solutions	0
Karma Given	2
Karma Received	2
Member Since	‎04-07-2014

Online Status	Offline
Date Last Visited	‎01-05-2024 11:57 AM

Convert decimal date time value in CSV export in E...

Transaction or Stats - need multiple starts and en...

Knowledge base within splunk

Re: Convert decimal date time value in CSV export ...

Re: Transaction or Stats - need multiple starts an...

Re: Knowledge base within splunk