Splunk Search

timechart day of week

ewanbrown
Path Finder

Hi,

I have a report which is a basic timechart, but in the output like to put the day of week as well as the day

So Monday 8 December

rather than

8 December

Is this possible?

Thanks

0 Karma

chimell
Motivator
    Try your search code like this : 

 your search here .... | convert timeformat="%A %d %B " ctime(_time) AS c_time |chart count by c_time

    it will give you the date format that you want. E.g : Monday 10 february  in X-Axis 
0 Karma

somesoni2
SplunkTrust
SplunkTrust

aholzer
Motivator

You can use the convert command. Select from these options the proper format you wish the date to show up in. Here's an example:

your search here... | convert timeformat="%A %d %B" ctime(_time)

This should result in changing the _time field to strings of the format: ["Full weekday name" "numerical Day of the month" "Full month name"], example: "Monday 08 December".

Hope this helps

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...