Splunk Search

Why does fieldformat not work if field is renamed?

seomaniv
Explorer

I have reviewed https://answers.splunk.com/answers/63730/using-fieldformat-and-rename.html?utm_source=typeahead&utm_... and that gives me a work-around, but I am wondering what is going on behind the interface that breaks "fieldformat" if the field name is then renamed for a better user experience when reviewing the dashboard? If I code my query with:

eval date=date/1000 | 
eval date=date-(strptime(strftime(date,"%Y-%m-%dT%H:%M:%S.%3N")." PDT","%Y-%m-%dT%H:%M:%S.%N%Z")-date) | 
table date, userid, username, role, page, account | 
fieldformat date=strftime(date, "%F %T") | 
rename date as "Pacific Time"

the resulting table shows the field "Pacific Time" as an epoch timestamp. If I remove the "rename" command:

eval date=date/1000 | 
eval date=date-(strptime(strftime(date,"%Y-%m-%dT%H:%M:%S.%3N")." PDT","%Y-%m-%dT%H:%M:%S.%N%Z")-date) | 
table date, userid, username, role, page, account | 
fieldformat date=strftime(date, "%F %T") | 

I get the "date" field properly formatted. Why? And am I stuck with not being able to rename a field that I wish to reformat?

Thanks.

John

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The fieldformat command doesn't change anything - it's just creates display-time instructions. If you rename the field then the display-time instructions fail because there is no longer a field by the specified name.

The solution is to apply fieldformat to the final name of the field. fieldformat "Pacific Time" = strftime("Pacific Time", "%F %T").

---
If this reply helps you, Karma would be appreciated.
0 Karma

seomaniv
Explorer

Thanks, Rich, but I'm still not getting it to work if I use "rename":

table Date, userid, username, role, page, account | 
rename Date as "Pacific Time", page as Path, userid as "Associate's ID", username as "Associate's Name", role as "Access Level", account as "Account Number" | 
fieldformat "Pacific Time" = strftime("Pacific Time", "%F %T")

gives me a column of "Pacific Time" that is blank, whereas:

table Date, userid, username, role, page, account | 
fieldformat Date = strftime(Date, "%F %T") | 
rename Date as "Pacific Time", page as Path, userid as "Associate's ID", username as "Associate's Name", role as "Access Level", account as "Account Number"

gives me a column named "Pacific Time" as an epoch timestamp (expected, given what you have said, though I had understood "rename" to re-name the field and drag with it all of the attributes already tied to that field), and:

table Date, userid, username, role, page, account | 
fieldformat Date = strftime(Date, "%F %T") | 
rename page as Path, userid as "Associate's ID", username as "Associate's Name", role as "Access Level", account as "Account Number"

gives me a column named Date that is formatted the way I would like. What I do not understand is why the first option gives me a blank column. It is as if, once "rename" has been run on the field, fieldformat will no longer work on that same field. Is it because "rename" changes it from an epoch timestamp to a string (or something else)?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try fieldformat "Pacific Time" = strftime('Pacific Time', "%F %T"). The single quotes tell Splunk the string is a field name and not literal text.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...