About senior_splunk

senior_splunk · ‎08-17-2020

@to4kawa apologies, I should have been more clear. The output of your code produces time that is adjusted correctly but includes microseconds in the output. I was simply looking for a way to produce the output without them. A co-worker who is much better with splunk than I am gave me the following which does the trick rex field=my_local_time mode=sed "s/\..*$//"

senior_splunk · ‎08-17-2020

@to4kawa thank you for this but I do have a question as I am still fairly new to Splunk. How can I have the corrected time not show the microseconds? I have this: 08/17/2020 10:18:43.071000 and I need this: 08/17/2020 10:18:43 Thanks in advance!

senior_splunk · ‎05-28-2014

Thanks for this fix.. Solved our issue

senior_splunk · ‎05-28-2014

Prior to our 6.1 upgrade, saved searches that sent emails that contained inline results of data in a table were viewable just as they are presented in the web UI. Now that we have upgraded to 6.1 the message portion of the results has lost all formatting and is run together. The message is windows event log data and I have before and after examples but currently my karma is too low to allow me to upload them. Can anyone assist in this issue? I can email or pm examples of the issue I am having. Cheers, David

Posts	4
Solutions	0
Karma Given	3
Karma Received	1
Member Since	‎05-28-2014

Online Status	Offline
Date Last Visited	‎08-18-2020 02:50 PM

Table data formatting incorrect in alert emails

Re: How do I convert a timestamp from one timezone...

Re: How do I convert a timestamp from one timezone...

Re: geoip command stops working after upgrade to 6...

Table data formatting incorrect in alert emails