topic how to display time of event as a table column in Splunk Search

how to display time of event as a table column

seanlon11 — Thu, 07 Apr 2011 20:25:10 GMT

I have the following query:

host=wps03 mc_getLDAPGroupsTimer | table time host username mc_getLDAPGroupsTimer | sort -mc_getLDAPGroupsTimer

I am trying to get the date and time to display in the table, so I can see what happened when, but I obviously have the syntax incorrect. Or, maybe this is not possible for some logical reason.

How can I display the date and time of an event in a table?

Thanks, Sean

Re: how to display time of event as a table column

southeringtonp — Thu, 07 Apr 2011 21:03:45 GMT

You have the right idea, but you appear to be missing the underscore at the beginning of the _time field.

Re: how to display time of event as a table column

seanlon11 — Thu, 07 Apr 2011 21:11:03 GMT

Awesome, worked like a charm!