Splunk Search

How can I display _time in my results using stats command?

EvansB
Path Finder

How can I display _time in my results using stats command
I get this field when I use "table _time"

EvansB_1-1645128730320.png
Just like the image above, I want to get the time field using stats and/or eval command
The image below is how my time events look like. 

EvansB_0-1645124157881.png

 

Labels (1)
Tags (1)
0 Karma

tshah-splunk
Splunk Employee
Splunk Employee

Hey @EvansB,

You can simply use the below query to get the time field displayed in the stats table

| stats values(time) as time by _time 

Here, I  have kept _time and time as two different fields as the image displays time as a separate field. If both time and _time are the same fields, then it should not be a problem using either. But if they are different fields, and you want to use _time, then you can replace _time with time in the values function.

---
If you find the answer helpful, an upvote/karma is appreciated

gcusello
SplunkTrust
SplunkTrust

Hi @EvansB,

let me understand: do you want to use _time for grouping events or as a field to display?

in the first case you could use the hint of @tshah-splunk , but is useful to add a bin command before the stats to group results, otherwise you'll have too many results:

| bin _time span=1d
| stats values(*) as * by _time 

if instead you need to display _time as a field, you can put it in the stats options, using some function:

  • values(to have all the distinct values of _time,
  • earliest to have the first value,
  • latest to have the latest value.

In both situations, you have also, at the end, to convert _time from epochtime to human readable format using strftime.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...