topic Re: _time field is missing for events in Getting Data In

_time field is missing for events

phildefer — Mon, 13 Nov 2023 22:51:00 GMT

My dataset has historical monthly average temperature for years 1745 to 2013. Since my source is a csv file, I used the following so the that the _time field represents the timestamp in each event :

source="Global warming trends.zip:*" source="Global warming trends.zip:./GlobalLandTemperaturesByMajorCity.csv" Country=Canada City=Montreal dt=*-01-* AverageTemperature="*" | eval _time=strptime(dt,"%Y-%m-%d")

However, all the events dated 1970 and prior don't have their timestamp in the 'Time' column, as per the attached capture. I suspect this has do do with Epoch time, but how do I fix this so I can vizualize my entire data set in a line chart?

Re: _time field is missing for events

ITWhisperer — Mon, 13 Nov 2023 23:03:05 GMT

Essentially, you can't represent dates prior to 1970 as a timestamp. However, you could convert your dates to an integer, e.g. 1752-09-03 becomes 17,530,903 (except that particular date didn't exist!), and 2023-11-13 becomes 20,231,113 etc.

Obviously, this doesn't work if you want to use times as well, and you shouldn't save these in _time as that might be treated as an epoch time i.e. seconds since 1970-01-01.

Re: _time field is missing for events

bowesmana — Tue, 14 Nov 2023 00:57:43 GMT

Although you cannot technically represent those dates pre 1970 as the internal _time field, you CAN use negative epoch times as strptime will work and correctly format the negative epochs as the correct time, but as you found, you cannot parse dates pre 1970, so you'd have to create your epochs through calculation.

Splunk is not great with non _time values on the X-axis of timecharts, but you can chart over a string, where the string could be YYYYMM and it will render it correctly, you just don't get the dates on the x-axis.

You can get the idea from this