All Apps and Add-ons

KV Store Time fields in lookup editor are not showing up correctly

ilyaresh
Path Finder

Hi,
I have a KVstore with time fields. below the definition
root@splunk652_01:/opt/splunk/etc/apps/search/local# cat collections.conf
[lvss_sla_queue_coll]
field.def_id = number
field.earliest_time = time
field.latest_time = time
field.schedule_time = time
field.sla_id = string
replicate = true

When I look at the KV store in the lookup editor (3.10 splunk 6.5.2) this is how it shows up
alt text

If I export or use |inputlookup all looks fine
alt text

is there something wrong with my data or a lookup editor bug?

Regards,
ILYA

0 Karma
1 Solution

ec4n6
Explorer

Yeah I'm having the same issue. The author is converting the stored epoch time using milliseconds instead of seconds

View solution in original post

0 Karma

LukeMurphey
Champion

I have a fix for this. The fix will be released in version 3.2.1.

Update:
I released version 3.2.1. You will need to clear the browser cache or bump Splunk to see the changes.

0 Karma

ilyaresh
Path Finder

Thank you very much Luke

0 Karma

ec4n6
Explorer

Amazing. Thank you!!!

0 Karma

ec4n6
Explorer
0 Karma

ilyaresh
Path Finder

Thanks for confirming and submitting an issue

0 Karma

ec4n6
Explorer

Yeah I'm having the same issue. The author is converting the stored epoch time using milliseconds instead of seconds

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...