Splunk Search

How to add a Date Field into my search and dashboard in Splunk Light?

dvadithala
New Member

Hi,

I'm completely new to Splunk and using Light version for evaluation. How can I add a date field into my search and also to the dashboard? I have Timestamp, date_mday, date_wday, date_hour etc.

But I wanted a date field for persistent field and also I wanted to use in my dashboard.

Please help.

Thanks,
Me

0 Karma

jedatt01
Builder

If I understand what you are asking correctly, try adding this to your query to create a date field with the time stripped off. It is derived from the _time field which is Splunk's internal representation of your event date/timestamp

| eval mytime=strftime(_time, "%Y%m%d")

Does that answer your question?

0 Karma

dvadithala
New Member

Thanks for replying back. I don't understand it. Sorry, it's me, as I'm beginner. Based on your response. I've added your expression as following under "Edit Search String" in the dashboard. But it doesn't show the dates.

Severity=Error | eval mytime=strftime(_time, "%Y%m%d")

How can I add Date field as a field, like Timestamp, date_mday etc?

Thanks again.
Me

0 Karma

jedatt01
Builder

when you use the eval command it will create a new field. In this case it's called mytime. You can use mytime just like you would use Timestamp or date_mday.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...