Solved: Eval Expression in Data Model - Splunk Community

Splunk Search

Hi,

I'm trying to create an eval expression in my data model which is based on _time. Can you please advise on what I'm doing wrong?

40 KB

1 Solution

Solution

My bad just put <<YOUR_CODE>> and try

strftime(_time,"%Y-%m-%d")

View solution in original post

remove | eval from eval block. just date=<<YOUR_CODE>>

Solution

My bad just put <<YOUR_CODE>> and try

strftime(_time,"%Y-%m-%d")

I get this error

39 KB

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...