Getting Data In

Why does the date format in scheduled csv report change in an email?

mcastino
New Member

I have made a scheduled report which emails a csv file containing counts of particular events for each day in the last seven days.

The format looks a little like this:

Date - X, Y, Z
2019-08-12 - 5, 6, 8
2019-08-13 - 10, 8, 7
2019-08-14 - 2, 1, 1

The output in the Splunk UI shows dates correctly ( | fieldformat Date= strftime(Date, "%Y-%m-%d" ), and when I download a CSV report manually the dates also look fine.

However, in the scheduled report sent via email, dates are presented as below:

Date
1565532000
1565618400
1565704800
1565791200
1565877600
1565964000
1566050400

Any thoughts on what's going on here?

Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

The actual data is still an integer. Generally you should be using fieldformat the way that you are, but if the output is going to be exported and you need human-readable dates, then swap fieldformat for eval like this:

... | eval Date=strftime(Date, "%Y-%m-%d")

View solution in original post

woodcock
Esteemed Legend

The actual data is still an integer. Generally you should be using fieldformat the way that you are, but if the output is going to be exported and you need human-readable dates, then swap fieldformat for eval like this:

... | eval Date=strftime(Date, "%Y-%m-%d")

mcastino
New Member

Thanks, will see how it goes!

0 Karma

woodcock
Esteemed Legend

Come back and let us know how it went and click Accept to close the question.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...