Splunk Search

How can i convert String Type Time field(a) to a human readable Date Type Time field(#)?

joy76
Path Finder

Splunk version 4.3

I want to sort human readable Time Field in Table results.

Date Type _time(timestamp) field is sorting well.
But String Type Time field is not sorting.

I tried to convert String Type Time to unixtime type, and convert unixtime type to human readable format.
but, I can't convert to human readable Date Time format.

Thanks. Everyone.

Tags (1)
1 Solution

ghostworks
Engager

Hi~ joy76~

First, a specific time-formatted filed is converted by mktime().
And then, use fieldformat command

  • example

field: Rebooting_Time

value: 2010-02-08 09:20:01

type: string

search
| convert timeformat="%Y-%m-%d %T" mktime(Rebooting_Time)  
| fieldformat Rebooting_Time=strftime(Rebooting_Time,"%Y-%m-%d %T")  
| Table Rebooting_Time

As a Result, values of Rebooting_Time is not only displayed for human readable time, but also it was sorted by time.

View solution in original post

ghostworks
Engager

Hi~ joy76~

First, a specific time-formatted filed is converted by mktime().
And then, use fieldformat command

  • example

field: Rebooting_Time

value: 2010-02-08 09:20:01

type: string

search
| convert timeformat="%Y-%m-%d %T" mktime(Rebooting_Time)  
| fieldformat Rebooting_Time=strftime(Rebooting_Time,"%Y-%m-%d %T")  
| Table Rebooting_Time

As a Result, values of Rebooting_Time is not only displayed for human readable time, but also it was sorted by time.

bwooden
Splunk Employee
Splunk Employee

You can also use an eval command instead of the convert command. This allows that logic to be performed automatically via calculated fields.

| eval Rebooting_Time=strptime(Rebooting_Time,"%Y-%m-%d %H:%M:%S")

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...