fieldformat command you can use
eval expressions to change the format of a field value when the results render. You can change the format without changing the underlying value of the field. Commands later in the search pipeline cannot modify the formatted value.
fieldformat command does not apply to commands that export data, such as the
output lookup commands. The export retains the original data format and not the rendered format. If you want the format to apply to exported data, use the
eval command instead of the
- Description: The name of a new or existing field, non-wildcarded, for the output of the eval expression.
- Syntax: <string>
- Description: A combination of values, variables, operators, and functions that represent the value of your destination field. For more information, see the eval command. For information about supported functions, see Usage.
Time format variables are frequently used with the
fieldformat command. See Date and time format variables.
You can use a wide range of functions with the
fieldformat command. For general information about using functions, see Evaluation functions.
The following table lists the supported functions by type of function. Use the links in the table to learn more about each function, and to see examples.
|Type of function||Supported functions and syntax|
|Comparison and Conditional functions||
|Date and Time functions||
|Multivalue eval functions||
|Statistical eval functions||
|Trigonometry and Hyperbolic functions||
Return metadata results for the sourcetypes in the main index.
| metadata type=sourcetypes | rename totalCount as Count firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update" | table sourcetype Count "First Event" "Last Event" "Last Update"
The fields are also renamed, but without the
fieldformat command the time fields display in Unix time:
Now use the
fieldformat command to reformat the time fields
| metadata type=sourcetypes | rename totalCount as Count firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update" | table sourcetype Count "First Event" "Last Event" "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "First Event"=strftime('First Event', "%c") | fieldformat "Last Event"=strftime('Last Event', "%c") | fieldformat "Last Update"=strftime('Last Update', "%c")
Note that the
fieldformat command is also used to reformat the Count field to display the values with commas. The results are more readable:
Assume that the
start_time field contains epoch numbers, format the
start_time field to display only the hours, minutes, and seconds corresponding to the epoch time.
... | fieldformat start_time = strftime(start_time, "%H:%M:%S")
To format numerical values in a field with a currency symbol, you must specify the symbol as a literal and enclose it in quotation marks. Use a period character as a binary concatenation operator, followed by the
tostring function, which enables you to display commas in the currency values.
...| fieldformat totalSales="$".tostring(totalSales,"commas")
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the fieldformat command.
This documentation applies to the following versions of Splunk® Enterprise: 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 7.0.0, 7.0.1