Splunk Search

Every _time timestamp in a transaction as a multivalue field

supersleepwalke
Communicator

How do I get all the individual event times from a transaction and have them in a multivalue field as part of the transaction?

Tags (3)
0 Karma
1 Solution

supersleepwalke
Communicator

Easy way to do this is just assign _time to another variable before the transaction. In the following example, I've also used strftime to convert from epoch to human-readable format:

sourcetype=foo "your search here" | eval times=strftime(_time,"%F %H:%M:%S") | transaction bar

Now times will be a multivalue field that contains all the individual timestamps from each event!

View solution in original post

supersleepwalke
Communicator

Easy way to do this is just assign _time to another variable before the transaction. In the following example, I've also used strftime to convert from epoch to human-readable format:

sourcetype=foo "your search here" | eval times=strftime(_time,"%F %H:%M:%S") | transaction bar

Now times will be a multivalue field that contains all the individual timestamps from each event!

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...