Splunk Search

How can I display _time in my results using stats command?

EvansB
Path Finder

How can I display _time in my results using stats command
I get this field when I use "table _time"

EvansB_1-1645128730320.png
Just like the image above, I want to get the time field using stats and/or eval command
The image below is how my time events look like. 

EvansB_0-1645124157881.png

 

Labels (1)
Tags (1)
0 Karma

tshah-splunk
Splunk Employee
Splunk Employee

Hey @EvansB,

You can simply use the below query to get the time field displayed in the stats table

| stats values(time) as time by _time 

Here, I  have kept _time and time as two different fields as the image displays time as a separate field. If both time and _time are the same fields, then it should not be a problem using either. But if they are different fields, and you want to use _time, then you can replace _time with time in the values function.

---
If you find the answer helpful, an upvote/karma is appreciated

gcusello
SplunkTrust
SplunkTrust

Hi @EvansB,

let me understand: do you want to use _time for grouping events or as a field to display?

in the first case you could use the hint of @tshah-splunk , but is useful to add a bin command before the stats to group results, otherwise you'll have too many results:

| bin _time span=1d
| stats values(*) as * by _time 

if instead you need to display _time as a field, you can put it in the stats options, using some function:

  • values(to have all the distinct values of _time,
  • earliest to have the first value,
  • latest to have the latest value.

In both situations, you have also, at the end, to convert _time from epochtime to human readable format using strftime.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...