Knowledge Management

How can I set KV store collection data for data type time, when using the REST API?

danrb1978
New Member

I am having trouble setting the value of a KV Store collection field of type time. Does anyone know the best way to do this through the REST API?

Some additional detail,

I have a KV Store collection, created through the REST API, which contains the following fields, with these types.

<s:key name="field.customerId">string</s:key>
<s:key name="field.notes">string</s:key>
<s:key name="field.expiration">time</s:key>

Next, I do a POST to my collection, with the following data:
{
"customerId":"123456",
"notes":"Expiration date should be 6/1/2016",
"expiration":"2016-06-01T12:00:00.000Z"
}

Last, I check the contents of the record:
{
"customerId": "123456",
"notes": "Expiration date should be 6/1/2016"
}

For some reason my expiration field won't persist data. I have taken a few guesses at the format required for my time field in the POST above, but have not had any success storing a value.

0 Karma

shaskell_splunk
Splunk Employee
Splunk Employee

You need to use a valid BSON data type and 'time' is not valid. Have a look at these two and see if either work.

https://docs.mongodb.org/manual/reference/bson-types/#date

https://docs.mongodb.org/manual/reference/bson-types/#timestamps

I believe you'll need to convert your date to epoch time as well.

eval epoch=strptime(expiration, "%Y-%m-%dT%H:%M:%S.%3NZ")

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...