topic Can't get results using _time in my search in Splunk Search

Can't get results using _time in my search

TheJagoff — Fri, 06 May 2016 00:29:07 GMT

I performed this search

index=* source="WinEventLog:System" EventCode=3 host=jj1 | table host, _time, message

and get the following results:

jj1 2016-05-02 18:27:04 Service started.
jj1 2016-05-02 18:23:55 VMCI: Using capabilities (0xc).

I want to narrow this down with the following search

index=* source="WinEventLog:System" EventCode=3 host=jj1 _time>="2016-05-02 18:27:04" |table host, _time, Message

I receive no results. Please advise on how to make this work.

Many thanks.

Re: Can't get results using _time in my search

sundareshr — Fri, 06 May 2016 01:10:46 GMT

_time is always in epoch time. Here is some information how you can use time modifiers to filter you data by time.

http://docs.splunk.com/Documentation/Splunk/6.0.6/SearchReference/SearchTimeModifiers

Re: Can't get results using _time in my search

woodcock — Fri, 06 May 2016 13:32:58 GMT

Check out the fieldformat command. Splunk automatically calls this inside every search so that, even though _time is actually a time_t and an integer, it is displayed to the user in his location-adjusted preference (in most cases, en_us). So your search should be:

index=* source="WinEventLog:System" EventCode=3 host=jj1 _time>= [|noop|stats count AS myTime | eval myTime = "2016-05-02 18:27:04" | convert timeformat="%Y-%m-%d %H:%M:%S" mktime(myTime) | return $myTime] |table host _time Message

Re: Can't get results using _time in my search

TheJagoff — Fri, 06 May 2016 14:10:30 GMT

THANK YOU!!!!!