topic Re: Issues with time parameter in Collect command in Splunk Search

Issues with time parameter in Collect command

arjit — Thu, 15 Oct 2020 05:44:49 GMT

Hi All, I am populating the summary index from yesterdays data via tstats count on a Data model and inspite of adding the addTime=t, the query is updating the time from _raw i.e. today instead of yesterdays date. My query is as below :

| tstats count AS "Trip Count" FROM datamodel=ourdatamodel

where Condition

| Collect index=xyz sourcetype=abc addTime=T (time parameter given in the scheduled report is -1d@d till @d)

When I tried extracting the info_min_time to check whether this parameter is available through

(The documentation states the collect command will look for info_min_time and if it is not present, then it will look for _time)

| tstats count AS "Trip Count", earliest(info_min_time) FROM datamodel=ourdatamodel .......

I am not getting any value for this field in the result.

Can you please suggest why inspite of adding addTime=T, we are not getting date as yesterday's date ?

Thanks

AG.

Re: Issues with time parameter in Collect command

thambisetty — Thu, 15 Oct 2020 06:00:26 GMT

The argument option addTime you used is wrong. it's supposed to be addtime ( t is lowercase in time).

addtime Syntax: addtime=<bool> Description: Use this option to specify whether to prefix a time field on to each event. Some commands return results that do not have a _raw field, such as the stats, chart, timechart commands. If you specify addtime=false, the Splunk software uses its generic date detection against fields in whatever order they happen to be in the summary rows. If you specify addtime=true, the Splunk software uses the search time range info_min_time. This time range is added by the sistats command or _time. Splunk software adds the time field based on the first field that it finds: info_min_time, _time, or now(). Default: true

Re: Issues with time parameter in Collect command

arjit — Thu, 15 Oct 2020 06:52:50 GMT

Hi @thambisetty , thanks for this but it accepts both addTime and addtime... I have already tried running both of them but both are not working ...

I suspect the problem must be with using tstats command on datamodel probably ... .

Please suggest if you have any suggestions here ...

Thanks

AG.

Re: Issues with time parameter in Collect command

ITWhisperer — Thu, 15 Oct 2020 08:10:22 GMT

Does the tstats actually return anything that could be a date/time? Try adding addinfo between the tstats and collect commands

Re: Issues with time parameter in Collect command

arjit — Thu, 15 Oct 2020 08:47:46 GMT

Thanks for this @ITWhisperer ! what I have done here is I have added addinfo|eval _time = info_min_time which is giving me the yesterday date! My new query, for the benefit of all the readers, is now:

| tstats count AS "Trip Count" FROM datamodel=ourdatamodel

where Condition

| addinfo| eval _time = info_min_time | Collect index=xyz sourcetype=abc addTime=T (time parameter given in the scheduled report is -1d@d till @d)

and this is giving me the desired date.

Kind regards

AG.