Splunk Search

Data model _time field format

BernardEAI
Communicator

We are trying to create a data model with a custom _time field. We created the data model, and added a calculated field (SUBMIT_DATE_cron_e) that calculates a UNIX time with microseconds (like 1619093900.0043). We then created another calculated field called _time, and set this equal to SUBMIT_DATE_cron_e. This effectively overwrites the inherited (or original) _time field. These steps worked well. 

A problem occurred when setting the data model to accelerated. If I do a search on the data model during the acceleration build process, and I inspect the _time field, I see times in UNIX format with microseconds (like 1619093900.0043), as intended. However as the build progresses, the _time values change to UNIX time with no microseconds (like 1619093900). It looks like the _time field is truncated to have only seconds.

Is this according to design for accelerated data models? Is there a way to have a _time field in UNIX format with micro seconds?

Labels (2)
0 Karma

easiedu_splunk
Splunk Employee
Splunk Employee

This is possible, but this approach requires a datamodel amendment.

If an ordinary search of the index showed timestamps with sub-seconds:

image001.png

 

but the equivalent tstats search did not:

image002.png

 

the workaround is to modify the datamodel to add another field which takes a copy of the full timestamp.  That additional field can either be retained like other fields or can be used to reinstate the timestamp with sub-second detail.  For example, create a calculated field “time_millis” that just takes a copy of _time.

image003.png

 

Now, if you return to  your tstats search from earlier and include time_millis, you can display time_millis and/or use it to reinstate the milliseconds of the _time field (i.e.  | eval _time=time_miilis):

image004.png

 

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...