Splunk Search

How can we modify the wrong _raw timestamp for a summary index?

abhijit_mhatre
Path Finder

After populating data under summary index we are getting wrong timestamp for all the fields.

Original search query:
index=ABC sourcetype=XYZ subtype=### earliest=-90d@d latest=now | eval date=strftime(_time, "%m/%d/%Y") | stats count as Incoming, count(eval(action="blocked")) as Blocked by date |collect index=summary_index source="***"

Post Summary index query:
index=summary_index source="***"

However, when i run the above query, I lose the actual timestamp of the event. Instead, all events in the summary index have the current system time as the timestamp.

0 Karma
1 Solution

somesoni2
Revered Legend

Change the Original Search like this

index=ABC sourcetype=XYZ subtype=### earliest=-90d@d latest=now  |timechart span=1d count as Incoming, count(eval(action="blocked")) as Blocked | eval date=strftime(_time, "%m/%d/%Y") |collect index=summary_index source="***"

View solution in original post

somesoni2
Revered Legend

Change the Original Search like this

index=ABC sourcetype=XYZ subtype=### earliest=-90d@d latest=now  |timechart span=1d count as Incoming, count(eval(action="blocked")) as Blocked | eval date=strftime(_time, "%m/%d/%Y") |collect index=summary_index source="***"

abhijit_mhatre
Path Finder

Thanks @somesoni2

The query worked & now we are getting correct timestamp for events.

0 Karma

jkat54
SplunkTrust
SplunkTrust

They should also have a field called date yes?

If you want the full timestamp add _time to you stats command by clause:

... by date _time

0 Karma

adonio
Ultra Champion

like jkat54 said, ... | stats strips the time from results. add "by _time" to have that field

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...