Splunk Search

fieldformat command giving error

sscandoit
Explorer

Hi,

I am using Splunk 4.1.2. I am trying to use fieldformat to format the _time to avoid converting it to string. Following is my search string:

index="someindex" sourcetype="log" | fieldformat mytime=strftime(_time,"%m/%d/%Y %k:%M") | table mytime, account_id

However I am getting the following error:

Search operation 'fieldformat' is
unknown. You might not have permission
to run this operation.

I think I am missing something here. Appreciate all the help I have got on this forum.

Thanks,
Suvelee

Lowell
Super Champion

The fieldformat search command isn't supported until Splunk 4.2.

0 Karma

bbingham
Builder

use "convert", try this:

index="someindex" sourcetype="log" | convert timeformat="%m/%d/%Y %k:%M" ctime(_time) AS mytime |table mytime, account_id

the function "ctime" is for converting epoch time to ascii. Hope it helps!

0 Karma

sscandoit
Explorer

For some reason, I didn't get an email for this comment. I tried | eval start_time=_time|fieldformat start_time = strftime(start_time,"%m/%d/%Y %k:%M") but this didn't work either. Its giving the same error. Thanks a lot.

I can use "sort" to order the results but that will do it one time. I wanted to let the user sort the results using up/down arrows provided by the simpleResultsTable.

0 Karma

bbingham
Builder

You can also pipe to "sort" to order it how you'd like, but try this:

| eval start_time=_time|fieldformat start_time = strftime(start_time,"%m/%d/%Y %k:%M")

0 Karma

sscandoit
Explorer

Thanks for the reply. I had used convert before. But it doesn't sort the timestamp in the results table. So to preserve the timestamp I tried using fieldformat.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...