strftime(X, Y) function

[tombonfert]

• Takes a UNIX time value, X, as the first argument and renders the time as a string using the format specified by Y.
• The UNIX time must be in seconds (from the Splunk documentation)
  • It is also possible to provide a field of timestamp type (e.g. ‘_time’) for argument X (see example)
• We do not support X in seconds, but only in timestamp format. We are applying Spark's 'date_format' function.
• Solution: Depending on the input type (seconds vs. timestamp) we need to apply either the ‘from_unixtime’ or ‘date_format’ function
  • Problem: If X is a field, we are not able to determine the data type of X