Splunk Search

Need to add Date/Time in report

runiyal
Path Finder

I have following record in my log -

2019-06-13 10:59:56,664 INFO [FileUploadWebScript] [http-apr-8983-exec-5] The Upload Service /filenet/service/temp/upload succeeded in 2.366000 seconds, Request: {account=0063, creator=Test, name=Itinerary}

I need a report showing a tabular report with following columns -
Name | Account | creator | uploaded On
Itinerary .... 0063..... Test...... 2019-06-13

"Upload On" should be from the start of the line i.e., "2019-06-13 10:59:56,664"

I am able to get all other columns except date/time by this query -

...| stats list(name) as "Name", list(account) as "Account", list(creator) as "Creator"

How to change this statement so that I can get "Uploaded On" too?

Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

... | eval uploaded_On = strftime(_time, "%Y-%m-%d %H:%M:%S")
| table Uploaded_On name account creator
| rename name AS Name account AS Account create AS Creator

View solution in original post

0 Karma

woodcock
Esteemed Legend

Try this:

... | eval uploaded_On = strftime(_time, "%Y-%m-%d %H:%M:%S")
| table Uploaded_On name account creator
| rename name AS Name account AS Account create AS Creator
0 Karma

runiyal
Path Finder

Thanks Woodcock, it worked.

0 Karma

runiyal
Path Finder

Hello Woodcock, somehow I am seeing some rows with Timestamp (Uploaded_ON) but no details around name, account & creator.
What we can do to make sure it shows record only if "name" is present?

Thanks!

0 Karma

woodcock
Esteemed Legend

Sure, just add | where isnotnull(name)

0 Karma

anilchaithu
Builder

@runiyal - You can use eval "Uploaded On"=_time in the query to display "2019-06-13 10:59:56,664". If you want to show only Date, Use eval "Uploaded On"=strftime(_time, "%Y-%m-%d") in the query.

0 Karma

Vijeta
Influencer

@runiyal- Is this the value of _time ?

0 Karma

runiyal
Path Finder

Vijeta, this is the time of the log entry....I may just need to show "2019-06-13" under "Uploaded On" column.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...