Splunk Search

How to add _time as an attribute in a base search object?

deanilol
Explorer

So I'd like to add the _time attribute to a base search object. As I understand it, I can't use the linear pivot diagram if I don't have _time on the x axis. Now what I want to do is to set _time=(another attribute) so that I can use the linear pivot diagram and choose my own attribute on the x-axis. My problem is that I can't find a way to add the _time as an attribute in the object.

Is there a way to do this without using root Event?

If not, how would I do the same thing using eval expressions in a root event object.

thanks!!

0 Karma

jmallorquin
Builder

Hi,

Have you try the command addinfo?

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Addinfo

Regards,

0 Karma

vganjare
Builder

Hi,

You can use eval to copy the _time value. Something like :

... | eval customTime = _time | ....

Thanks!!

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...