I'm using Splunk for the first time, and I have an sql query giving the following output: 2020-08-31 00:17:34.608, EMPTY_DATE="2020-12-03 00:00:00.0", ANTAL="2", SUM(AMOUNT)="2533"   The "SUM(AMOUNT)" is not saved under a name/alias (which I should have done retrospectively). However, now I don't know how to get the data out. I've tried to the following (but I suspect Splunk get's confused with a name which is also a function): | table  ANTAL "SUM(AMOUNT)" Is there a way to get the number out without going back and adding a name/alias to the sql? ... View more

I struggle with converting a time stamp into a date. In my data EMPTY_DATE looks like this: 2020-08-27 00:00:00.0   I have tried the following: | convert timeformat="%m/%d/%Y" ctime(EMPTY_DATE) AS date   ...and this: |eval date=strftime(EMPTY_DATE, "%m/%d/%Y")   ...and this: | eval time=strptime(EMPTY_DATE,"%Y%m%dT%H:%M:%S.%Q") | convert timeformat="%d%m%Y" ctime(time) as date |   All of the above returns empty columns. I don't know if it's because it doesn't recognize my time stamp or something else? ... View more