topic Re: different time fields in use in _audit index in Splunk Search

Why do some entries (of type search) have api_et, api_lt, and others have apiStartTime,apiEndTime?

jason0 — Thu, 23 Jun 2022 19:00:42 GMT

Hello,

I am digging through my _audit index to see what searches people are running over time, but I am confused by the following fields.

api_et , api_It
apiStartTime, apiEndTime

It would appear that api_et and apiEndTime are the same thing. same with api_lt, and api_StartTime. I get that api_(el)t are epoch times, and the others are formatted dates.

Why do some entries (of type search) have api_et, api_lt, and others have apiStartTime,apiEndTime? Thus far I have to do any calculations based on the presence of both sets and use coalesce to choose between the one that's not bogus.

--jason

Re: different time fields in use in _audit index

gcusello — Thu, 23 Jun 2022 06:51:23 GMT

Hi @jason0,

I don't know why there's this behaviour, this i a question for Splunk Project Team, but anyway, you already identified the solution: use coalesce to be sure to have a value for calculations.

Ciao.

Giuseppe

Re: different time fields in use in _audit index

jason0 — Fri, 24 Jun 2022 15:36:21 GMT

Thanks Guiseppe, I appreciate your response. It helps me a lot!

--jason

Re: different time fields in use in _audit index

gcusello — Fri, 24 Jun 2022 15:39:07 GMT

Hi @jason0

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉