Hello!
I am trying to combine 2 fields into 1 field.
One of my field is named date_mday, which stores all the days in the month, 1-30/31
Another field is named date_month, which stores all the month in the year, Jan-Dec
I need to combine these 2 fields into one field. For example, "8 Aug" or "20 Jan".
May i ask if there is any ideas for me to do so?
Thanks.
EDIT
Now, I am able to produce a graph, however is there any way for me to sort the time?
Graph: http://i40.tinypic.com/2ai0zzn.png
Hi Zyon,
try this:
<search here> | eval date_readable=date_mday." ".date_month
You have to remember that this will just be a string and Splunk will not treat it as a date for the purposes of sorting.
Hope this helps 🙂
Hi Zyon,
try this:
<search here> | eval date_readable=date_mday." ".date_month
You have to remember that this will just be a string and Splunk will not treat it as a date for the purposes of sorting.
Hope this helps 🙂
Alright. Thanks a lot.
This sounds like an issue with timestamp extraction in the original event. Unfortunately I can't help you right now, but if you put another question up, I think someone will be able to assist you shortly!
Alright! But i have another doubt and have no idea on how it could be done. It is asked above.
Great! If you could mark the answer as accepted (the tick box) that'll help other people who are searching with the same problem 🙂
Happy Splunking!
Thanks, it works!