Splunk Search

How to format timechart time values easily

ericrobinson
Path Finder

Not a splunk newbie, but I cant seem to figure out how to format my timechart values to be readable. The default format:

2013-08-28T14:30:00.000-04:00

Is not ideal for reading, and is normally too much information.

Tags (1)
0 Karma

Ayn
Legend

Use fieldformat to create the format you want.

... | timechart ... | fieldformat _time=strftime(_time,"%+")

For some inspiration on format strings, visit http://strfti.me/

Ayn
Legend

I personally check the strftime man pages on any UNIX system I happen to have nearby. They're available on the web too, of course: http://linux.die.net/man/3/strftime for instance.

0 Karma

ericrobinson
Path Finder

This seems to work great, but where can I find the options for strftime? I dont see a "%+" formatting option from your link..

0 Karma

sowings
Splunk Employee
Splunk Employee

(Not having tried this yet...) does it keep the format for any tooltips as well?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>