Metrics Index - How to get metric_searchtime field value in search result

[shadabgaur]

I uploaded a csv file in metric index. I can see index's data there is no issue in that.

My query is:
I want to get metric_timestamp in search query to perform some action on that. Is it possible to use "metric_timestamp" field in mstat commands? I always get error whenever I tried to apply any statistical function (i.e. latest etc) on "metric_timestamp" or used it as a dimension field (where index=xyz by metric_timestamp).

mcatalog just displays the schema, not the values from "metric_timestamp" field.

Any help is greatly appreciated. Thanks!

[thaggie_splunk · Accepted solution]

For mstats to project by time you need to give it a span, so queries of the form:

| mstats avg("abc") WHERE index="xyz" span=10s

It's not possible to aggregate time, so you can't do things like latest("_time").

[shadabgaur]

Thanks for quick response Thaggie. So, we cannot use this field "metric_timestamp" in anywhere in our search except spanning the chart based on it.

[thaggie_splunk]

That's right