Knowledge Management

How to store dates in a KV store collection

malvidin
Communicator

When configuring a collection, "date" and "number" are both options. I assumed that "date" would be the correct way to store a date, but it only worked for me when I used "number".

 

| inputlookup my_kv_lookup where my_time < [ makeresults | eval rel_time = relative_time(now(), "-1d@d") | return $rel_time ]

 

When I used "date", the same filter worked, but only after returning the entire collection. 

 

| inputlookup my_kv_lookup 
| where my_time < [ makeresults | eval rel_time = relative_time(now(), "-1d@d") | return $rel_time ]

 

Is there a way to filter a value stored in a "date" field?

Did I make a mistake on what values I put into the "my_time" field (epoch times straight from _time)? 

Does it need to be accelerated?

Labels (2)
Tags (2)
0 Karma
1 Solution

anilchaithu
Builder

@malvidin 

Do you mean time when you mentioned date here? I don't think date is a field type

Please refer 

https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Collectionsconf

anilchaithu_0-1595251558906.png

It should work with time

Hope this helps

 

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I can't find where "date" and "number" are options when creating a collection. Where do you see it?
The relative_time function returns time in epoch format (integer) so that's why "number" works better.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

anilchaithu
Builder

@malvidin 

Do you mean time when you mentioned date here? I don't think date is a field type

Please refer 

https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Collectionsconf

anilchaithu_0-1595251558906.png

It should work with time

Hope this helps

 

malvidin
Communicator

I had looked at that document, but somehow put "date" instead of "time". It is working fine with "time" or "number".

Is there any benefit to using "time" over "number", besides indicating what the number represents?

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...