Splunk Search

How to format timechart time values easily

ericrobinson
Path Finder

Not a splunk newbie, but I cant seem to figure out how to format my timechart values to be readable. The default format:

2013-08-28T14:30:00.000-04:00

Is not ideal for reading, and is normally too much information.

Tags (1)
0 Karma

Ayn
Legend

Use fieldformat to create the format you want.

... | timechart ... | fieldformat _time=strftime(_time,"%+")

For some inspiration on format strings, visit http://strfti.me/

Ayn
Legend

I personally check the strftime man pages on any UNIX system I happen to have nearby. They're available on the web too, of course: http://linux.die.net/man/3/strftime for instance.

0 Karma

ericrobinson
Path Finder

This seems to work great, but where can I find the options for strftime? I dont see a "%+" formatting option from your link..

0 Karma

sowings
Splunk Employee
Splunk Employee

(Not having tried this yet...) does it keep the format for any tooltips as well?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...