My query index= nonjVs source = nonjavs | stats vaules(_time ) as start time values(_time) as endtime by empid
Displayed below formate but I want to see my stat time and end time "%m-%d-%y %H:%M:@%S"
Starttime 165575758474.67768
End time 16777894894.67788
Hi @Sekhar,
you have to use the eval command, with the strftime funtion, after the stats command:
index=nonjVs source=nonjavs
| stats earliest(_time) AS starttime latest(_time) AS endtime BY empid
| eval starttime=strftime(starttime,"%m-%d-%y %H:%M:%S"), endtime=strftime(endtime,"%m-%d-%y %H:%M:%S")
Ciao.
Giuseppe
Hi @Sekhar,
you have to use the eval command, with the strftime funtion, after the stats command:
index=nonjVs source=nonjavs
| stats earliest(_time) AS starttime latest(_time) AS endtime BY empid
| eval starttime=strftime(starttime,"%m-%d-%y %H:%M:%S"), endtime=strftime(endtime,"%m-%d-%y %H:%M:%S")
Ciao.
Giuseppe
Hi @Sekhar ,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉