Hi,
I need to be able to change the _time column header to something else instead of just saying _time (I guess that you call it field?)
I have been trying to change it, but when I do I end up with missing data below the _time header or it reverts to a timestamp that isn't useable to the average human
.
I know that you all might want to alter the existing search, but I am not permitted to change the search very much at all for reasons beyond the scope of this post.
Here is what I have:
somecoolmacro
sourcetype="123_blabla" | rex field=source "someplace\(?[\w\s-]*)" | dedup temp | table temp _time | rename temp as "Date of what I need to know" | fieldformat _time = strftime(_time, "%b %d, %Y")
Thanks in advance!!
P.S. The first part of the search was intended to be accent grave then somecoolmacro then accent grave
I am not sure why it did that.
Do you satisfy with solution from here https://answers.splunk.com/answers/1275/renaming-time-field-causes-an-unwanted-result.html?
| eval my_time=_time | convert timeformat="%Y-%m-%d" ctime(my_time)
Playing around with it, but it is giving me an extra column and slings an unwanted date column like before.
Do you satisfy with solution from here https://answers.splunk.com/answers/1275/renaming-time-field-causes-an-unwanted-result.html?
| eval my_time=_time | convert timeformat="%Y-%m-%d" ctime(my_time)