https://community.splunk.com/t5/Getting-Data-In/Event-Timestamp-is-combination-of-2-fields-StartTime-DeltaTime/m-p/47472#M9004 <P>We need to use as the event timestamp the EndTime of the event but the EndTime is a calculated field from 2 other actual fields: StartTime + DeltaTime. Is this possible?</P> Sat, 19 Feb 2011 06:31:31 GMT woodcock 2011-02-19T06:31:31Z https://community.splunk.com/t5/Getting-Data-In/Event-Timestamp-is-combination-of-2-fields-StartTime-DeltaTime/m-p/47472#M9004 <P>We need to use as the event timestamp the EndTime of the event but the EndTime is a calculated field from 2 other actual fields: StartTime + DeltaTime. Is this possible?</P> Sat, 19 Feb 2011 06:31:31 GMT https://community.splunk.com/t5/Getting-Data-In/Event-Timestamp-is-combination-of-2-fields-StartTime-DeltaTime/m-p/47472#M9004 woodcock 2011-02-19T06:31:31Z https://community.splunk.com/t5/Getting-Data-In/Event-Timestamp-is-combination-of-2-fields-StartTime-DeltaTime/m-p/47473#M9005 <P>Hm. Well if you want the events to get indexed with that timestamp, i dont think it can be done. but someone else might know of a way. </P> <P>If On the other hand, the _time as indexed today is close enough, but you just want to use this other more accurate value when you run reports, then you can modify the _time field itself. </P> <P> | eval _time = StartTime + DeltaTime | timechart count</P> <P>Of course, if the indexed _time value is off by enough to push it outside of the search timerange, then it wont show up in the report at all. </P> Sat, 19 Feb 2011 06:36:28 GMT https://community.splunk.com/t5/Getting-Data-In/Event-Timestamp-is-combination-of-2-fields-StartTime-DeltaTime/m-p/47473#M9005 sideview 2011-02-19T06:36:28Z