How to insert data from kv store to index with customized _time coloumn

[jitendragupta]

I am inserting data from kv store to Index but in index it is taking insertion time by default in _time column but I want my custom time same as from_date column in kv store.
How can I achieve this?

This query is not working for me:
| inputlookup kv_demo | head 10 | eval _time = from_date | table myid name from_date | collect index= demoindex

[mayurr98]

hey @jitendragupta

in your eval command you have assigned from_date to _time but in table you are using from_date
You should change that to _time instead. Also you want demoindex to index only 10 events? Or you are just trying this out?

| inputlookup kv_demo | head 10 | eval _time = from_date | table _time myid name | collect index=demoindex

This will store data into summary index called demoindex
If you directly run this command you will get error Received event for unconfigured/disabled/deleted index=demoindex with source="..and so on
So first create and index called demoindex and then run this query

let me know if this helps!

[jitendragupta]

Even after correcting search query as you said, i am not able to get my custom time in _time Column of index.

_time column is storing data insertion time by default.
I want to copy my custom time from from_date column of my kv store.
As u can see in this image from_date and _time are different:

[jitendragupta]

Image URL:

https://drive.google.com/open?id=1UU4E02SJmthdBvLChUxDUvtZ9ZBr8Egl

[mayurr98]

okay i got it ! can you give me sample values from from_date field? i want to know the format of values are they in epoch time?

[jitendragupta]

Any format like dd/mm/yy for date and hh:mm:ss for time is ok with me. But the main thing which I am expecting is, from_date column should copy to _time column.

If this is possible than than only I can proceed with my work.

[mayurr98]

it wont add anything specific if you have from_date="dd/mm/yy hh:mm:ss"
then you have to make change | eval _time=strptime(from_date,"%d/%m/%Y")
you have to give the format of from_date value

I can see from the screenshot that your from_date has only dd/mm/yy so accordingly i have changed my query

[mayurr98]

run this

 | inputlookup kv_demo | head 10 | eval _time=strptime(from_date,"%d/%m/%Y") | table _time myid name | collect index=demoindex

let me know if this helps !

[493669]

Hi @jitendragupta,
can you try below:

  | inputlookup kv_demo | head 10 | eval _time = from_date | table myid name _time| collect index= demoindex

[493669]

here you have to convert your time to epoch(in seconds) so that Time format to get understood by splunk
so try below it will work:

 | inputlookup kv_demo | head 10 | eval _time = from_date |eval _time=strptime(_time,"%d/%m/%Y")| table myid name _time| collect index= demoindex

using strptime time command it will parse your time field in format "%d/%m/%Y" and converts it in epoch then by table command you are entering required field to get collected in index.
Hope this helps you.
Cheers.