Hello Splunk Community
I am trying to convert a timestamp, StartTime (current format: 2014-05-09T19:11:52.5165976Z) in my log file data to a simple DD-MON-YY formatting. I have found a number of solutions in these forums, but I cannot seem to get it to work despite numerous attempts.
My original search is: sourcetype="logfile" Status="*" | chart dc(UserId) by StartTime | SORT dc(UserId) desc
I have tried implementing the following code: strptime(StartTime, "%d-%b-%Y") but this makes the Search fail. I’ve also tried using the eval command, but still no results are returned.
Any help would be greatly appreciated.
Thank you,
Mike
... View more