Dashboards & Visualizations

strftime empties stats-ed field

altink
Builder

Hi

after I try to format datetime field - it shows empty

 

index=_audit action=alert_fired ss_app=omega_core_audit
| convert ctime(trigger_time)
| eval Criticality = case(severity=1,"Info", severity=2, "Low", severity=3, "Medium", severity=4,"High", severity=5, "Critical", 1=1, severity)
| stats earliest(trigger_time) as min_time, latest(trigger_time) as max_time, count by ss_name Criticality
| eval min_time = strftime(min_time,"%Y-%m-%d %H:%M:%S")

 



field min_time returns NULL after I try to set format.
(max_time is OK - but without format)


please advise on how to correctly output the datetime fields with desired format

regards

Altin

Labels (1)
0 Karma
1 Solution

anilchaithu
Builder

@altink 

strftime converts UNIX time to regualr readable time. From the SPL, the min_time & max_time are already converted in line 2 of the code. Simply you can remove line 2 OR you can add the following stanzas

| eval min_time = strftime(strptime(min_time,"%m/%d/%Y %H:%M:%S"),"%Y-%m-%d"))

| eval max_time = strftime(strptime(max_time,"%m/%d/%Y %H:%M:%S"),"%Y-%m-%d"))

 

-- Hope this helps

View solution in original post

0 Karma

altink
Builder

even If I replace

line:

| eval min_time = strftime(min_time,"%Y-%m-%d %H:%M:%S")

 

with
| fieldformat min_time = strftime(min_time,"%Y-%m-%d %H:%M:%S")

still I get an empty min_time field

0 Karma

altink
Builder

can anyone advise on this ?

regards
Altin

0 Karma

anilchaithu
Builder

@altink 

strftime converts UNIX time to regualr readable time. From the SPL, the min_time & max_time are already converted in line 2 of the code. Simply you can remove line 2 OR you can add the following stanzas

| eval min_time = strftime(strptime(min_time,"%m/%d/%Y %H:%M:%S"),"%Y-%m-%d"))

| eval max_time = strftime(strptime(max_time,"%m/%d/%Y %H:%M:%S"),"%Y-%m-%d"))

 

-- Hope this helps

0 Karma

altink
Builder

thank you

if I remove line 2 I get unix time only.

if I remove the two my last evals I get the default datime format - but what I need is a formated as below:
y-m-d H:M:S

your two proposed stanzas return NULL - with or without line 2

0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...