Archive
Highlighted

Set Custom time as _time

Path Finder

Hi All,

I have requirement like we have custom time field ALERTDATETIME i want to display graph where my custom time field should be primary time field. This could have been easy if they asked just display ALERTDATETIME stats but they want time filter in graph where if they select last 7days or expanding to 30 days the data should be displayed based on ALERTDATETIME not the _time field. So am stuck here how to set custom time field as _time when user filtering date.

The date format of ALERTDATETIME is "%Y-%m-%d %H:%M:%S", need to convert only %Y-%m-%d. I tried something like below query but didn't work.

base search
| eval _time=strptime(ALERTDATETIME,"%Y-%m-%d")
| stats count by _time

Thanks!
Pavan

0 Karma
Highlighted

Re: Set Custom time as _time

Champion

Hi kpavan,

Please try following link:
link text

0 Karma
Highlighted

Re: Set Custom time as _time

Champion

When the user searches for, say, 7 days, do they expect that search to return results where ALERTDATETIME is within that 7 day window, or do they only want the resulting output to make use of ALERTDATETIME?

0 Karma
Highlighted

Re: Set Custom time as _time

Path Finder

Hi Micahkemp

Thanks for reply!

They want to When the user searches for, say, 7 days, do they expect that search to return results where ALERTDATETIME is within that 7 day window

Thanks!

0 Karma
Highlighted

Re: Set Custom time as _time

Champion

In that case you need to ensure the timepicker range selected encompasses the full time range of the actual _time field that may have events with ALERTDATETIME in the desired range. That may mean users can't select 7 days from the timepicker if they want 7 days based on ALERTDATETIME.

The timepicker will only define your time window based on _time.

0 Karma
Highlighted

Re: Set Custom time as _time

Super Champion

try using this:

base search
| addinfo 
| eval _time=strptime(ALERTDATETIME,"%Y-%m-%d") 
| where _time>=info_min_time AND (info_max_time="+Infinity" OR _time<=info_max_time)
| stats count by _time

that should allow for use of the time picker.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.