topic Re: Field _time should be less than a week in Splunk Search

Field _time should be less than a week

d12harshal — Fri, 19 Jul 2013 08:42:41 GMT

Dear Splunkers,
My search results contain fields Name, Time as Test1, Test2, Test3, Test4 and 1375351200.000, 1417863600.000, 1375351200.000, 1375351200.000

My Requirement: I trying to convert time to human readable standard format, and also final report must only contain a report with time(date) less than a week. Adding of extra fields also not a problem.

Could any please help me out. Thanks in advance.

Regards,
Harshal

Re: Field _time should be less than a week

jgedeon120 — Fri, 19 Jul 2013 12:28:12 GMT

Add the following and then add the field time to your table.
| convert ctime(_time) as time

Then set your search range for past seven days or specify the time range in the time range picker.

Re: Field _time should be less than a week

d12harshal — Mon, 28 Sep 2020 14:23:38 GMT

Its custom time, so not possible to set the time range. Following search worked for me.

... | convert timeformat="%m/%e/%Y %I:%M:%S %p" mktime(Time) AS Time_epoch mktime(now) AS now_epoch | eval age=round((Time_epoch-now_epoch)/60/60/24)

Re: Field _time should be less than a week

amit_saxena — Sun, 28 Jul 2013 13:55:45 GMT

Hi,

I am not sure why "mktime" instead "ctime" was used here.

I would suggest the following search command.

... | convert timeformat="%m/%d/%y %H:%M:%S" ctime(Time) as NewTime | where now() - Time < 604800

Let me know if it works for you.

EDIT: Just realized that earliest will work for "_time" field only which is not the time field for your case. So modified the search query to use "now". However the newer search might not work in all cases. The number 604800 is equal to number of seconds in a week.

Regards,
Amit Saxena

Re: Field _time should be less than a week

d12harshal — Wed, 14 Aug 2013 10:59:41 GMT

Sorry it was a long time, but in my case it is not possible with ctime.