Refine your search:

When I schedule the following search and send a report through email, the date/time in the attached .csv file does not show the correct format, it shows the numerical time ie. 1287990000.

index=_internal todaysBytesIndexed LicenseManager-Audit NOT source=*web_service.log | eval Daily_Indexing_Volume_in_MBs = todaysBytesIndexed/1024/1024 | timechart avg(Daily_Indexing_Volume_in_MBs) by host

Running the search in the UI and as an exported report will return a readable date.

10/25/10 00:00:00.000 AM

How do I convert the date/time format in the .csv file?

asked 08 Nov '10, 23:16

Jaci's gravatar image

Jaci ♦
8722217
accept rate: 75%


One Answer:

One of several options:

| convert ctime(_time) as timestamp 

Also, see previous thread:
     http://answers.splunk.com/questions/6971/how-to-format-time-field-in-results-email

link

answered 09 Nov '10, 00:44

southeringtonp's gravatar image

southeringtonp ♦
4.5k1215
accept rate: 35%

Does anyone know why this isn't handled automatically in the sendemail.py script? I mean, does anyone ever really want to see _time as an epoch value? Is this because of some kind of timezone thing?

(09 Nov '10, 15:23) Lowell ♦

Easy enough to modify the script yourself, but agreed that at least _time specifically should be automatic. Maybe time to file another ER...

(10 Nov '10, 02:38) southeringtonp ♦
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×200
×173
×96

Asked: 08 Nov '10, 23:16

Seen: 1,128 times

Last updated: 12 Apr '11, 22:22

Copyright © 2005-2012 Splunk, Inc. All rights reserved.