topic Re: How to get event _time from CIM data model? in Splunk Search

How to get event _time from CIM data model?

phil_wong — Tue, 12 Jan 2021 07:22:05 GMT

I checked CIM data models have inherited _time but I couldn't retrieve.

Anyone can tell what's wrong?

| tstats summariesonly=true allow_old_summaries=true count from datamodel=Network_Traffic.All_Traffic where All_Traffic.action=allowed by All_Traffic.src All_Traffic.dest All_Traffic._time

Re: How to get event _time from CIM data model?

scelikok — Tue, 12 Jan 2021 07:45:37 GMT

Hi @phil_wong,

Metadata field are accessible without node name. You should use _time like below;

| tstats summariesonly=true allow_old_summaries=true count from datamodel=Network_Traffic.All_Traffic where All_Traffic.action=allowed by All_Traffic.src All_Traffic.dest _time

If this reply helps you an upvote is appreciated.

Re: How to get event _time from CIM data model?

General_Talos — Tue, 12 Jan 2021 08:16:55 GMT

Thanks @scelikok

@phil_wong

Please note "_time,source, sourcetype and host" fields in datamodel are default fields and doesn't require node_name in field-name

To get list of field name available in datamodel use

| datamodel <datamodel_name> search

Re: How to get event _time from CIM data model?

phil_wong — Tue, 12 Jan 2021 09:00:48 GMT

Just happend _time is not in the field list. So I was lost my mind.

Thanks for the suggestion!