Splunk version 4.3
I want to sort human readable Time Field in Table results.
Date Type _time(timestamp) field is sorting well.
But String Type Time field is not sorting.
I tried to convert String Type Time to unixtime type, and convert unixtime type to human readable format.
but, I can't convert to human readable Date Time format.
Thanks. Everyone.
Hi~ joy76~
First, a specific time-formatted filed is converted by mktime().
And then, use fieldformat command
field: Rebooting_Time
value: 2010-02-08 09:20:01
type: string
search
| convert timeformat="%Y-%m-%d %T" mktime(Rebooting_Time)
| fieldformat Rebooting_Time=strftime(Rebooting_Time,"%Y-%m-%d %T")
| Table Rebooting_Time
As a Result, values of Rebooting_Time is not only displayed for human readable time, but also it was sorted by time.
Hi~ joy76~
First, a specific time-formatted filed is converted by mktime().
And then, use fieldformat command
field: Rebooting_Time
value: 2010-02-08 09:20:01
type: string
search
| convert timeformat="%Y-%m-%d %T" mktime(Rebooting_Time)
| fieldformat Rebooting_Time=strftime(Rebooting_Time,"%Y-%m-%d %T")
| Table Rebooting_Time
As a Result, values of Rebooting_Time is not only displayed for human readable time, but also it was sorted by time.
You can also use an eval command instead of the convert command. This allows that logic to be performed automatically via calculated fields.
| eval Rebooting_Time=strptime(Rebooting_Time,"%Y-%m-%d %H:%M:%S")