topic Re: time field search in load job not working in Getting Data In

time field search in load job not working

surekhasplunk — Sat, 29 Aug 2020 04:02:03 GMT

Hi,

I have a savedsearch which i am calling like below.

| loadjob savedsearch="admin:Splunk_Security:chk_coding_pie_accl" |search Time="*2020-08-24*"

When i have to use Time tokens then its not working

This loadjob query is my pie chart query for a panel where earlist time and latest time will be as per the choosen time from the time field.

Now when i try to pass this like below i get no results although it has value for that Time.

|loadjob savedsearch="admin:appname:savedsearch" |search earliest=$field1.earliest$ latest=$field1.latest$ | stats count by Manager

How to pass the time properly here ?

thambisetty — Sat, 29 Aug 2020 06:05:30 GMT

you should pass something like below:

| search earliest=“” latest=“”

the format of earliest and latest is

%m/%d/%Y:%H:%M:%S

surekhasplunk — Wed, 09 Sep 2020 08:38:20 GMT

I understand that i have to change the format but it doesn't work as expected. I added the where clause but looks like that doesn't work.

| where Time=strptime("1599503400","%Y-%m-%d %H:%M:%S")

thambisetty — Wed, 09 Sep 2020 08:56:03 GMT

First, convert your Time field using below eval Time_epoch and then you need to pass your value in where in epoch time.