topic Re: Set Custom time as _time in Splunk Search

Set Custom time as _time

kpavan — Wed, 20 Dec 2017 05:43:55 GMT

Hi All,

I have requirement like we have custom time field ALERTDATETIME i want to display graph where my custom time field should be primary time field. This could have been easy if they asked just display ALERTDATETIME stats but they want time filter in graph where if they select last 7days or expanding to 30 days the data should be displayed based on ALERTDATETIME not the _time field. So am stuck here how to set custom time field as _time when user filtering date.

The date format of ALERTDATETIME is "%Y-%m-%d %H:%M:%S", need to convert only %Y-%m-%d. I tried something like below query but didn't work.

base search
| eval _time=strptime(ALERTDATETIME,"%Y-%m-%d")
| stats count by _time

Thanks!
Pavan

Re: Set Custom time as _time

p_gurav — Wed, 20 Dec 2017 05:54:51 GMT

Hi kpavan,

Please try following link:
link text

Re: Set Custom time as _time

micahkemp — Wed, 20 Dec 2017 11:59:46 GMT

When the user searches for, say, 7 days, do they expect that search to return results where ALERTDATETIME is within that 7 day window, or do they only want the resulting output to make use of ALERTDATETIME?

Re: Set Custom time as _time

cmerriman — Wed, 20 Dec 2017 12:39:54 GMT

try using this:

base search
| addinfo 
| eval _time=strptime(ALERTDATETIME,"%Y-%m-%d") 
| where _time>=info_min_time AND (info_max_time="+Infinity" OR _time<=info_max_time)
| stats count by _time

that should allow for use of the time picker.

Re: Set Custom time as _time

kpavan — Wed, 20 Dec 2017 14:45:39 GMT

Hi Micahkemp

Thanks for reply!

They want to When the user searches for, say, 7 days, do they expect that search to return results where ALERTDATETIME is within that 7 day window

Thanks!

Re: Set Custom time as _time

micahkemp — Thu, 21 Dec 2017 00:45:26 GMT

In that case you need to ensure the timepicker range selected encompasses the full time range of the actual _time field that may have events with ALERTDATETIME in the desired range. That may mean users can't select 7 days from the timepicker if they want 7 days based on ALERTDATETIME.

The timepicker will only define your time window based on _time.