Reporting

Current time in SimData event attributes

praneshd
Engager

Using SimData to manufacture some artificial events into our Splunk world. However, SimData not allowing or provided any API which allows to set System date ( current date) to any attributes in event.

entity User {
    init {
        id = "bot-id";
    }
    every(spinOffPriquency m) {
        var sessionID = Guid();
        emit LogUserRequest {
                               instanceId: id
                             observationTime: <Current Time>;
        }
    }
}

Above example, I want to set observationTime to current system time. I don't see any method/api DLS (domain specific language) [page][1]

Some extent Template allows to set current time using {{_time}} but, this wont hit to template as an splunk event.

dponcelow_splun
Splunk Employee
Splunk Employee

This is a good point. Seems like we need a time function that takes a format and returns a string representation of the current simulation time. I'll try to get it into the next release.

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...