Knowledge Management

How can I set "_time" = "initialQueryTime" in the summary index?

lpolo
Motivator

I need to set the "_time" of a summary index equal to the time of a field value.
Like for example:
Event:


abc

In this particular example I need to set "_time" = "initialQueryTime" in the summary index.
I tried using in my schedule search the following eval:
eval _time=relative_time(initialQueryTime, "0d@d") but it does not work.

I am able to get the date but not the time of the date like this:
eval _time=relative_time(now(), "-23d@d")

How can I set "_time" = "initialQueryTime" in the summary index?

Any idea.....

Thanks for your help....

Lp

Tags (1)

lpolo
Motivator

I could not find a solution. So I used "eval _time=relative_time(initialQueryTime, "0d@d")"

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...