https://community.splunk.com/t5/Getting-Data-In/Metrics-Index-How-to-get-metric-searchtime-field-value-in-search/m-p/393541#M70274 <P>For mstats to project by time you need to give it a span, so queries of the form:</P> <PRE><CODE>| mstats avg("abc") WHERE index="xyz" span=10s </CODE></PRE> <P>It's not possible to aggregate time, so you can't do things like latest("_time").</P> Tue, 09 Apr 2019 15:58:13 GMT thaggie_splunk 2019-04-09T15:58:13Z https://community.splunk.com/t5/Getting-Data-In/Metrics-Index-How-to-get-metric-searchtime-field-value-in-search/m-p/393540#M70273 <P>I uploaded a csv file in metric index. I can see index's data there is no issue in that.</P> <P>My query is:<BR /> I want to get metric_timestamp in search query to perform some action on that. Is it possible to use "metric_timestamp" field in mstat commands? I always get error whenever I tried to apply any statistical function (i.e. latest etc) on "metric_timestamp" or used it as a dimension field (where index=xyz by metric_timestamp). </P> <P>mcatalog just displays the schema, not the values from "metric_timestamp" field. </P> <P>Any help is greatly appreciated. Thanks!</P> Tue, 29 Sep 2020 23:59:02 GMT https://community.splunk.com/t5/Getting-Data-In/Metrics-Index-How-to-get-metric-searchtime-field-value-in-search/m-p/393540#M70273 shadabgaur 2020-09-29T23:59:02Z https://community.splunk.com/t5/Getting-Data-In/Metrics-Index-How-to-get-metric-searchtime-field-value-in-search/m-p/393541#M70274 <P>For mstats to project by time you need to give it a span, so queries of the form:</P> <PRE><CODE>| mstats avg("abc") WHERE index="xyz" span=10s </CODE></PRE> <P>It's not possible to aggregate time, so you can't do things like latest("_time").</P> Tue, 09 Apr 2019 15:58:13 GMT https://community.splunk.com/t5/Getting-Data-In/Metrics-Index-How-to-get-metric-searchtime-field-value-in-search/m-p/393541#M70274 thaggie_splunk 2019-04-09T15:58:13Z https://community.splunk.com/t5/Getting-Data-In/Metrics-Index-How-to-get-metric-searchtime-field-value-in-search/m-p/393542#M70275 <P>Thanks for quick response Thaggie. So, we cannot use this field "metric_timestamp" in anywhere in our search except spanning the chart based on it. </P> Wed, 10 Apr 2019 00:54:17 GMT https://community.splunk.com/t5/Getting-Data-In/Metrics-Index-How-to-get-metric-searchtime-field-value-in-search/m-p/393542#M70275 shadabgaur 2019-04-10T00:54:17Z https://community.splunk.com/t5/Getting-Data-In/Metrics-Index-How-to-get-metric-searchtime-field-value-in-search/m-p/393543#M70276 <P>That's right</P> Wed, 10 Apr 2019 14:39:03 GMT https://community.splunk.com/t5/Getting-Data-In/Metrics-Index-How-to-get-metric-searchtime-field-value-in-search/m-p/393543#M70276 thaggie_splunk 2019-04-10T14:39:03Z