Knowledge Management

How can I set KV store collection data for data type time, when using the REST API?

danrb1978
New Member

I am having trouble setting the value of a KV Store collection field of type time. Does anyone know the best way to do this through the REST API?

Some additional detail,

I have a KV Store collection, created through the REST API, which contains the following fields, with these types.

<s:key name="field.customerId">string</s:key>
<s:key name="field.notes">string</s:key>
<s:key name="field.expiration">time</s:key>

Next, I do a POST to my collection, with the following data:
{
"customerId":"123456",
"notes":"Expiration date should be 6/1/2016",
"expiration":"2016-06-01T12:00:00.000Z"
}

Last, I check the contents of the record:
{
"customerId": "123456",
"notes": "Expiration date should be 6/1/2016"
}

For some reason my expiration field won't persist data. I have taken a few guesses at the format required for my time field in the POST above, but have not had any success storing a value.

0 Karma

shaskell_splunk
Splunk Employee
Splunk Employee

You need to use a valid BSON data type and 'time' is not valid. Have a look at these two and see if either work.

https://docs.mongodb.org/manual/reference/bson-types/#date

https://docs.mongodb.org/manual/reference/bson-types/#timestamps

I believe you'll need to convert your date to epoch time as well.

eval epoch=strptime(expiration, "%Y-%m-%dT%H:%M:%S.%3NZ")

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...