strftime(X, Y) function

Takes a UNIX time value, X, as the first argument and renders the time as a string using the format specified by Y.
The UNIX time must be in seconds (from the Splunk documentation)
- It is also possible to provide a field of timestamp type (e.g. ‘_time’) for argument X (see example)
We do not support X in seconds, but only in timestamp format. We are applying Spark's 'date_format' function.
Solution: Depending on the input type (seconds vs. timestamp) we need to apply either the ‘from_unixtime’ or ‘date_format’ function
- Problem: If X is a field, we are not able to determine the data type of X

Navigation Menu