topic Re: create a field alias for _indextime in Splunk Search

create a field alias for _indextime

Shihua — Tue, 30 Jan 2024 05:45:05 GMT

Hi everyone,

I would want to ask if I can create a field alias for _indextime and _time then set this alias as a default field for all sourcetype?

Re: create a field alias for _indextime

gcusello — Tue, 30 Jan 2024 06:44:11 GMT

Hi @Shihua,

it isn't a good idea because many commands as timechart run using _time, in addition you should do this for all sourcetypes! and I'm not sure that's possible!

then why do you want to do this?

you have these fields in epochtime, so you can use them for calculations and _time is automatically displayed in human readable, so why?

if you don't like the fieldname _time, you can rename it at the end of the searches.

You could create at index time a new field from them, but why?

Ciao.

Giuseppe

Re: create a field alias for _indextime

gcusello — Tue, 30 Jan 2024 08:34:59 GMT

Hi @Shihua ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉