Splunk Search

dbinspect fields names and format changed in 6.*

mataharry
Communicator

I was using dbinpect to calculates the first and last events in my buckets.
In splunk 4.* and 5.*, it was returning 2 fields earliestTime and latestTime as a date in my SH timezone.

But I do not find those fields anymore in 6.*, how to get them ?

Tags (2)
1 Solution

yannK
Splunk Employee
Splunk Employee

Yes, the format of dbinspect changed in 6.*
see http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Dbinspect

The time fields were renamed and converted to epoch time.

  • earliestTime (in formatted time ) became endEpoch (in epoch)
  • latestTime (in formatted time ) became startEpoch (in epoch)

You can update your searches to use the new fields, or do a simple conversion.

| dbinspect
| convert ctime(endEpoch) AS earliestTime
| convert ctime(startEpoch) AS latestTime

View solution in original post

dlutzy
Engager

you need to switch:

earliestTime (in formatted time ) became startEpoch (in epoch)
latestTime (in formatted time ) became endEpoch (in epoch)

yannK
Splunk Employee
Splunk Employee

Yes, the format of dbinspect changed in 6.*
see http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Dbinspect

The time fields were renamed and converted to epoch time.

  • earliestTime (in formatted time ) became endEpoch (in epoch)
  • latestTime (in formatted time ) became startEpoch (in epoch)

You can update your searches to use the new fields, or do a simple conversion.

| dbinspect
| convert ctime(endEpoch) AS earliestTime
| convert ctime(startEpoch) AS latestTime

mattymo
Splunk Employee
Splunk Employee
| convert ctime(endEpoch) AS latestTime | convert ctime(startEpoch) AS earliestTime

gotta get yannK to flip the fields in the convert

startEpoch - The timestamp for the first event in the bucket (the time-edge of the bucket furthest towards the past), in number of seconds from the UNIX epoch.

endEpoch - The timestamp for the last event in the bucket, which is the time-edge of the bucket furthest towards the future. Specify the timestamp in the number of seconds from the UNIX epoch.

- MattyMo
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...