How to store dates in a KV store collection

[malvidin]

When configuring a collection, "date" and "number" are both options. I assumed that "date" would be the correct way to store a date, but it only worked for me when I used "number".

| inputlookup my_kv_lookup where my_time < [ makeresults | eval rel_time = relative_time(now(), "-1d@d") | return $rel_time ]

When I used "date", the same filter worked, but only after returning the entire collection. 

| inputlookup my_kv_lookup 
| where my_time < [ makeresults | eval rel_time = relative_time(now(), "-1d@d") | return $rel_time ]

Is there a way to filter a value stored in a "date" field?

Did I make a mistake on what values I put into the "my_time" field (epoch times straight from _time)? 

Does it need to be accelerated?

[richgalloway]

I can't find where "date" and "number" are options when creating a collection. Where do you see it?
The relative_time function returns time in epoch format (integer) so that's why "number" works better.

[anilchaithu · Accepted solution]

@malvidin 

Do you mean time when you mentioned date here? I don't think date is a field type

Please refer 

https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Collectionsconf

It should work with time

Hope this helps

[malvidin]

I had looked at that document, but somehow put "date" instead of "time". It is working fine with "time" or "number".

Is there any benefit to using "time" over "number", besides indicating what the number represents?