topic Re: Using a different value for _time in Splunk Search

Using a different value for _time

williamsmew — Wed, 30 Sep 2020 00:32:41 GMT

index=av sourcetype=BobsCutRateAV category="BadStuffHappening"
| eval date_hour=strftime(_time, "%H")
| eval date_wday = strftime(_time, "%w")
| search (date_hour>18 OR date_hour<6) OR (date_wday=0 OR date_wday=6)
| timechart count

This works. The problem is that _time reflects when the event is reported not when it was detected. The field I need is detected_timestamp which is formatted as detected_timestamp="2019-04-11 02:31:52.0"

I did not create this but have been tasked with modifying it. I have looked at documentation and the many things I have tried do not work. Your help is appreciated.

Re: Using a different value for _time

martin_mueller — Wed, 30 Sep 2020 00:29:26 GMT

Assuming you always want to use detected_timetamp and never what is now _time, I'd recommend changing the timestamp extraction for that sourcetype. See https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Configuretimestamprecognition for how, and open new questions with any issues you might have.

If you want to do this in some search without changing the data getting indexed because most of the time what is now _time is the right time and only this time you want detected_timestamp, you can do something like this:

... | eval _time = strptime(detected_timestamp, "%F %T.%N") | eval date_hour = ...

XOR

... | eval date_hour ... | eval date_wday = ... | search ... | eval _time = strptime(detected_timestamp, "%F %T.%N") | timechart count

depending on whether the date_hour/date_wday filters you have right now should be applied to _time or detected_timestamp.

Re: Using a different value for _time

williamsmew — Sat, 11 May 2019 22:34:02 GMT

Thanks for the response

Im confused where the "%F %T.%N" is from and how %H and %w is extracted, from what I can find I was using "%Y-%m-%d %H:%M:%S.%1n"

I dont have much in the way of resources to pull from here, these forums will be about it, so thank you.

Re: Using a different value for _time

williamsmew — Sat, 11 May 2019 22:48:06 GMT

And yes this is for a search being piped into a dashboard

Re: Using a different value for _time

martin_mueller — Sat, 11 May 2019 23:35:12 GMT

%F is short for %Y-%m-%d, %T is short for %H:%M:%S - see http://www.strftime.net/ for an easy to use reference.

Re: Using a different value for _time

williamsmew — Wed, 30 Sep 2020 00:32:44 GMT

Yup, finally found that under Date and time variables. What perplexes me is why eval _time = strptime(detected_timestamp, "%Y-%m-%d %H:%M:%S.%N") does not work since it seems to be the the same as the F T N

Re: Using a different value for _time

martin_mueller — Sun, 12 May 2019 00:04:16 GMT

Does this work in an empty search bar?

| makeresults | eval detected_timestamp="2019-04-11 02:31:52.5" | eval _time = strptime(detected_timestamp, "%Y-%m-%d %H:%M:%S.%N")

Re: Using a different value for _time

williamsmew — Sun, 12 May 2019 00:15:51 GMT

Yes it does