topic Re: How to write a search for a specific timestamp? in Splunk Search

How to write a search for a specific timestamp?

Mubarish — Tue, 19 Aug 2014 13:18:35 GMT

Hi,
I have my search query which returns a table. In the table, Timestamp is one of my field. Format of the Timestamp field is YYYY/MM/DD HH:MM:SS (i.e) Date(Space)Time
For example
2014/07/10 03:17:44
2014/07/10 03:17:14 etc.
I want to search Timestamp suppose
for example basequery... | search Timestamp = 2014/07/10 03:17:44 , the record with that particular date&time has to display. Since there is a space between date and time, my search shows no result found. How can I search for a specific timestamp?

Re: How to write a search for a specific timestamp?

pradeepkumarg — Tue, 19 Aug 2014 13:24:33 GMT

Did you try this?

basequery| search Timestamp = "2014/07/10 03:17:44"

Re: How to write a search for a specific timestamp?

MuS — Tue, 19 Aug 2014 13:26:31 GMT

Hi Mubarish,

simply use double quotes around the value like in this run everywhere search command (you must be able to search index=_internal) :

 index=_internal "[19/Aug/2014:15* +0200]"

This will show all event from today (as it is the 19th of August 2014) 3pm

hope this helps ...

cheers, MuS

Re: How to write a search for a specific timestamp?

somesoni2 — Tue, 19 Aug 2014 17:20:03 GMT

Your logs in Splunk should have _time field in epoch format. You can convert your token value to epoch and compare against _time value.

your base search _time=[|gentimes start=-1 | eval search=strptime("YourDateValue","%Y/%m/%d %H:%M:%S" | table search]