Splunk Search

Help Ungrouping Time Range on event search


Hi everyone,

I have found this search for GlobalProtect on PaloAlto Networks App, The information showed its really usefull, the only problem I have it's. How do I show receive_time or time of the log on the Results.

| tstats summariesonly=t latest(log.event_id) AS latest_event, values(log.agent_message) AS log.agent_message, values(log.src_ip) AS log.src_ip count FROM datamodel="pan_firewall" WHERE nodename="log.system.globalprotect" """" groupby _time log.event_id log.user

when i erase the * _time* field, this colum disappear, and if I try something like values(log.receive_time) it doesn't show any information.

I just want to show the time without a groupby cause this groups all the logs to 30 mins time all logs example; 10:00 am - 10:30 am.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...