topic Re: dbinspect fields names and format changed in 6.* in Splunk Search

dbinspect fields names and format changed in 6.*

mataharry — Mon, 25 Nov 2013 16:17:46 GMT

I was using dbinpect to calculates the first and last events in my buckets.
In splunk 4.* and 5.*, it was returning 2 fields earliestTime and latestTime as a date in my SH timezone.

But I do not find those fields anymore in 6.*, how to get them ?

Re: dbinspect fields names and format changed in 6.*

yannK — Mon, 25 Nov 2013 16:21:06 GMT

Yes, the format of dbinspect changed in 6.*
see http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Dbinspect

The time fields were renamed and converted to epoch time.

earliestTime (in formatted time ) became endEpoch (in epoch)
latestTime (in formatted time ) became startEpoch (in epoch)

You can update your searches to use the new fields, or do a simple conversion.

| dbinspect | convert ctime(endEpoch) AS earliestTime | convert ctime(startEpoch) AS latestTime

Re: dbinspect fields names and format changed in 6.*

dlutzy — Wed, 14 Oct 2015 00:47:08 GMT

you need to switch:

earliestTime (in formatted time ) became startEpoch (in epoch)
latestTime (in formatted time ) became endEpoch (in epoch)

Re: dbinspect fields names and format changed in 6.*

mattymo — Wed, 26 Oct 2016 13:26:19 GMT

| convert ctime(endEpoch) AS latestTime | convert ctime(startEpoch) AS earliestTime

gotta get yannK to flip the fields in the convert

startEpoch - The timestamp for the first event in the bucket (the time-edge of the bucket furthest towards the past), in number of seconds from the UNIX epoch.

endEpoch - The timestamp for the last event in the bucket, which is the time-edge of the bucket furthest towards the future. Specify the timestamp in the number of seconds from the UNIX epoch.