topic Overriding _time in Splunk Search

Overriding _time

msarro — Wed, 28 Sep 2011 13:21:42 GMT

Greetings everyone. Is there any way to modify _time's value for the sake of a single search? One of our sources has the time set 2 hours behind where it should be. We have to present data tomorrow, and it will take at least a week to re-index everything. Any ideas would be appreciated.

Re: Overriding _time

vlapeintuit — Mon, 28 Sep 2020 09:55:34 GMT

you can perform a regex on the field where the time is and search based on that time. an example....

rex field=_raw "(?\d{4}\/\d{2}\/\d{2}) (?\d{2}:\d{2}:\d{2})" | sort by new_date,new_time

Re: Overriding _time

dwaddle — Wed, 28 Sep 2011 18:03:50 GMT

You can munge time with eval. Something like this should work:

... | eval _time=if(source=="/some/bad/source",_time+7200,_time)

Things can get slightly wonky doing stuff like this though. You may need to resort by time (| sort -_time), and because this is a post-search processing of the data your search window will need to be large enough to be inclusive of the whole time window.

I would definitely plan on a reindex to fix the fouled data. But this might get you through your demo tomorrow.

Re: Overriding _time

chris — Wed, 08 Feb 2012 08:50:17 GMT

Hi, I have been struggling with this for a long time. Thanks a lot. I am trying to display events from the past in the same graph as current events in a graph (Today vs last week).