topic Re: how to use a field as timestamp with epoch time for a timechart in Splunk Search

how to use a field as timestamp with epoch time for a timechart

Ralf — Mon, 16 Nov 2020 14:47:34 GMT

Hi there,

I did already several trials with search commands like "eval _time=strptime(time,"%Y-%m-%dT%H:%M:%S")"
but was not able to manage that time chart is using my own timestamp in the message uploaded.

The data has originally same _time as the upload is done by bulk upload of a log file that contains then several events with there own timestamp in the format: time: 2020-11-16T15:15:51.113394

I'd like to show cpu_percentage over my own time stamp.

Hope somebody can help out here

Ralf

Re: how to use a field as timestamp with epoch time for a timechart

ITWhisperer — Mon, 16 Nov 2020 15:03:04 GMT

Has time been successfully extracted from your events?

Re: how to use a field as timestamp with epoch time for a timechart

Ralf — Mon, 16 Nov 2020 15:15:37 GMT

yes, time: 2020-11-16T15:15:51.113394. is part of my event

Re: how to use a field as timestamp with epoch time for a timechart

Ralf — Tue, 17 Nov 2020 10:11:01 GMT

sorry, what do you mean by "extracted" ?

What I can see, please see also the screen dump on my question is, that the time field in the message show a different time than Splunk time.

That I would say can be expected as Splunk recognize the time of uploading

Re: how to use a field as timestamp with epoch time for a timechart

ITWhisperer — Tue, 17 Nov 2020 11:32:16 GMT

If you expand the event

Do you see time (as well as _time) as a field?

Re: how to use a field as timestamp with epoch time for a timechart

Ralf — Tue, 17 Nov 2020 12:18:27 GMT

looks like this:

Re: how to use a field as timestamp with epoch time for a timechart

ITWhisperer — Tue, 17 Nov 2020 12:27:20 GMT

The eval you mentioned should work so long as you do it before the timechart. What do you get if you do the eval and then expand the event as before - does _time = time?

Re: how to use a field as timestamp with epoch time for a timechart

Ralf — Tue, 17 Nov 2020 12:59:15 GMT

original message looks like this:

after trying with this eval command: - don't know if it is 100% correct

eval _time=strptime(time,"%Y-%m-%d %H:%M:%S.%Q")

it looks like this

Re: how to use a field as timestamp with epoch time for a timechart

ITWhisperer — Tue, 17 Nov 2020 13:12:12 GMT

It looks like the eval worked - so timechart should now work as it uses _time

Re: how to use a field as timestamp with epoch time for a timechart

Ralf — Tue, 17 Nov 2020 13:15:12 GMT

unfortunately not:

everything looks empty even when I saw the events are there

Re: how to use a field as timestamp with epoch time for a timechart

ITWhisperer — Tue, 17 Nov 2020 13:33:33 GMT

Interesting picture. You are doing a timechart using values. If you look at the statistics, you will probably see a multivalue field values(cpu_percentage) against each time bucket (quarter of an hour). This cannot be visualised in this way. What is it you are trying to achieve?