Knowledge Management

How to store dates in a KV store collection

malvidin
Communicator

When configuring a collection, "date" and "number" are both options. I assumed that "date" would be the correct way to store a date, but it only worked for me when I used "number".

 

| inputlookup my_kv_lookup where my_time < [ makeresults | eval rel_time = relative_time(now(), "-1d@d") | return $rel_time ]

 

When I used "date", the same filter worked, but only after returning the entire collection. 

 

| inputlookup my_kv_lookup 
| where my_time < [ makeresults | eval rel_time = relative_time(now(), "-1d@d") | return $rel_time ]

 

Is there a way to filter a value stored in a "date" field?

Did I make a mistake on what values I put into the "my_time" field (epoch times straight from _time)? 

Does it need to be accelerated?

Labels (2)
Tags (2)
0 Karma
1 Solution

anilchaithu
Builder

@malvidin 

Do you mean time when you mentioned date here? I don't think date is a field type

Please refer 

https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Collectionsconf

anilchaithu_0-1595251558906.png

It should work with time

Hope this helps

 

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I can't find where "date" and "number" are options when creating a collection. Where do you see it?
The relative_time function returns time in epoch format (integer) so that's why "number" works better.

---
If this reply helps you, Karma would be appreciated.
0 Karma

anilchaithu
Builder

@malvidin 

Do you mean time when you mentioned date here? I don't think date is a field type

Please refer 

https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Collectionsconf

anilchaithu_0-1595251558906.png

It should work with time

Hope this helps

 

malvidin
Communicator

I had looked at that document, but somehow put "date" instead of "time". It is working fine with "time" or "number".

Is there any benefit to using "time" over "number", besides indicating what the number represents?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...