About Laurent

Laurent · ‎05-27-2024

Hello many thanks for the feedback now it's working perfectly, it was the story of the simple quote instead of the double 👍 thanks again

Laurent · ‎05-23-2024

Hello i have done the following query but this is not affecting the result of the column Start Time on the result! eval fields "Start Time" = strftime(strptime("Start Time", "%FT%T.%Q%Z"), "%F %T") | reverse When i try directly on the value of this fields whith a query it's works! index="xxx" x | table "Interface" "Status"| stats latest("Status") as latest_time by "Interface"| eval latest_time=strftime(strptime(latest_time, "%FT%T.%Q%Z"), "%F %T") | sort 0 - latest_time i think it's more a problem with the position of the eval on the query which doesn't affect the display! thanks Laurent

Laurent · ‎05-22-2024

Hello no start time is in this format 2024-05-20T04:00:53.847Z and after the eval the result is the same 2024-05-20T04:00:53.847Z ! how to put on epoch time and transform it? thanks Laurent

Laurent · ‎05-21-2024

Hello, thanks for answering there is no errors the time formating is not take into account here my query: <query>index="xxx" earliest=$timerange.earliest$ latest=$timerange.latest$ | table guid, "parameter", "value"| xyseries "guid", "parameter", "value" | fields "guid" "type" "Start Time" "End Time" "Duration" | eval fields "Start Time" = strftime("Start Time", "%d/%m/%y %H:%M:%S") | sort 0 - "Start Time" </query> as i explained start time is not reformated as expected it's on orignal format! guid type start time end time duration 2024-05-20T04:00:53.536Z incremental 2024-05-20T04:00:53.847Z 2024-05-20T04:01:05.815Z 00:00:12 thanks Laurent

Laurent · ‎04-30-2024

The date transformation is working, i test it. My concerned is how(where) to insert it in my search query . When i add the transfo at the end of the query nothing happen. Here my full request which display a table well structured but with the date end and start date in this format 2024-04-30T12:01:04.215Z and not in this one 2024-04-30 14:01:04 search | table guid property value| | xyseries guid property value | fields guid start end duration status | eval start=strftime(strptime(start, "%FT%T.%Q%Z"), "%F %T")

Laurent · ‎04-30-2024

thanks, i have tried that to reformat the field start but it result in an empty field. | xyseries guid property value | fields guid start end duration status | eval start=strftime(strptime(start, "%FT%T.%Q%Z"), "%F %T")

Laurent · ‎04-30-2024

i have test the format directly to the value it's work. my concerne is to apply it after the xseries on => | fields guid start end duration status . On the result of the field start if i put the eval at the end it doesn't work.

Laurent · ‎04-30-2024

Yes but is it to apply the result of the date reformating provided into a fields of this answer :). But i can open a new topic if necessary

Laurent · ‎04-30-2024

Hello , | fields guid start end duration status is there way to reformat a field for exemple here the start? i want to apply the format done by that : | eval start=strftime(strptime(start, "%FT%T.%Q%Z"), "%F %T") Thanks LAurent

Laurent · ‎04-30-2024

Hi, thanks for answering it's work perfectly with that | eval latest_time=strftime(strptime(latest_time, "%FT%T.%Q%Z"), "%F %T") Thanks again for your answer. Laurent

Laurent · ‎04-29-2024

Hello i read many topics on zulu time but i m not able to solde one i have a date in this way 2024-04-29T12:01:15.710Z i just want it this way YYYY-MM-DD HH:MM:SS. i trie this eval latest_time = strptime(latest_time, "%Y-%m-%dT%H:%M:%S.%3N%Z") and the result is that : 1714363262.904000 i really don't catch the proble! Thanks Laurent

Laurent · ‎04-22-2024

Thanks it's work great. Is there a way to order the value of the column property?

Laurent · ‎04-19-2024

hello i have a list of events structured with the following fields : guid (uniqueid), property (name of a property ), value ( value link to the property name). i have 4 specific properties that I received separately on different events and the key is the guid to consolidate the information property/value by guid i make a search => search xxx | table guid , property , value i m able to have all the events in a table in this way guid property value 1 start 1 1 end 2 1 duration 1 1 status OK 2 start 1 2 end 3 2 duration 2 2 status KO I try to transpose the result in this way => search xxx | table guid , property , value | transpose 0 header_field="property" tho have a result like this : guid start end duration status 1 1 2 1 OK 2 1 3 2 KO but the result is not good, is there a way to easily search and display in a readable table this kind of structured events? Other need, how to simply display by guid the status and duration ? Thanks for your help regards Laurent

Posts	13
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎04-19-2024

Online Status	Offline
Date Last Visited	‎05-27-2024 10:49 AM

Zulu time

Tranpose on specific structure events

Re: Tranpose on specific structure events

Re: Tranpose on specific structure events

Re: Tranpose on specific structure events

Re: Tranpose on specific structure events

Re: Tranpose on specific structure events

Re: Tranpose on specific structure events

Re: Tranpose on specific structure events

Re: Tranpose on specific structure events

Re: Tranpose on specific structure events

Re: Zulu time

Zulu time

Re: Tranpose on specific structure events

Tranpose on specific structure events

Are you a member of the Splunk Community?