Knowledge Management

How to store dates in a KV store collection

malvidin
Communicator

When configuring a collection, "date" and "number" are both options. I assumed that "date" would be the correct way to store a date, but it only worked for me when I used "number".

 

| inputlookup my_kv_lookup where my_time < [ makeresults | eval rel_time = relative_time(now(), "-1d@d") | return $rel_time ]

 

When I used "date", the same filter worked, but only after returning the entire collection. 

 

| inputlookup my_kv_lookup 
| where my_time < [ makeresults | eval rel_time = relative_time(now(), "-1d@d") | return $rel_time ]

 

Is there a way to filter a value stored in a "date" field?

Did I make a mistake on what values I put into the "my_time" field (epoch times straight from _time)? 

Does it need to be accelerated?

Labels (2)
Tags (2)
0 Karma
1 Solution

anilchaithu
Builder

@malvidin 

Do you mean time when you mentioned date here? I don't think date is a field type

Please refer 

https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Collectionsconf

anilchaithu_0-1595251558906.png

It should work with time

Hope this helps

 

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I can't find where "date" and "number" are options when creating a collection. Where do you see it?
The relative_time function returns time in epoch format (integer) so that's why "number" works better.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

anilchaithu
Builder

@malvidin 

Do you mean time when you mentioned date here? I don't think date is a field type

Please refer 

https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Collectionsconf

anilchaithu_0-1595251558906.png

It should work with time

Hope this helps

 

View solution in original post

malvidin
Communicator

I had looked at that document, but somehow put "date" instead of "time". It is working fine with "time" or "number".

Is there any benefit to using "time" over "number", besides indicating what the number represents?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!