Getting Data In

_time field is missing for events

phildefer
Explorer

My dataset has historical monthly average temperature for years 1745 to 2013. Since my source is a csv file, I used the following so the that the _time field represents the timestamp in each event :

 

source="Global warming trends.zip:*" source="Global warming trends.zip:./GlobalLandTemperaturesByMajorCity.csv" Country=Canada City=Montreal dt=*-01-*  AverageTemperature="*"  
| eval _time=strptime(dt,"%Y-%m-%d")

 

However, all the events dated 1970 and prior don't have their timestamp in the 'Time' column, as per the attached capture. I suspect this has do do with Epoch time, but how do I fix this so I can vizualize my entire data set in a line chart?

Screenshot 2023-11-13 174412.jpg

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Although you cannot technically represent those dates pre 1970 as the internal _time field, you CAN use negative epoch times as strptime will work and correctly format the negative epochs as the correct time, but as you found, you cannot parse dates pre 1970, so you'd have to create your epochs through calculation.

Splunk is not great with non _time values on the X-axis of timecharts, but you can chart over a string, where the string could be YYYYMM and it will render it correctly, you just don't get the dates on the x-axis.

You can get the idea from this

| makeresults count=3000
| streamstats c
| eval _time=now() - (c * (86400 * 30)) 
| eval month=strftime(_time, "%Y-%m")
| eval r=random() % 100
| chart avg(r) as r over month
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Essentially, you can't represent dates prior to 1970 as a timestamp. However, you could convert your dates to an integer, e.g. 1752-09-03 becomes 17,530,903 (except that particular date didn't exist!), and 2023-11-13 becomes 20,231,113 etc.

Obviously, this doesn't work if you want to use times as well, and you shouldn't save these in _time as that might be treated as an epoch time i.e. seconds since 1970-01-01.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...