Splunk Search

How to get event _time from CIM data model?

phil_wong
Explorer

I checked CIM data models have inherited _time but I couldn't retrieve. 

Anyone can tell what's wrong? 

| tstats summariesonly=true allow_old_summaries=true count from datamodel=Network_Traffic.All_Traffic where All_Traffic.action=allowed by All_Traffic.src All_Traffic.dest All_Traffic._time

Labels (1)
Tags (2)
0 Karma
1 Solution

General_Talos
Path Finder

Thanks @scelikok 

@phil_wong 

Please note "_time,source, sourcetype and host" fields in datamodel  are default fields and doesn't require node_name in field-name

To get list of field name available in datamodel use

| datamodel <datamodel_name> search

 

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @phil_wong,

Metadata field are accessible without node name. You should use _time like below;

| tstats summariesonly=true allow_old_summaries=true count from datamodel=Network_Traffic.All_Traffic where All_Traffic.action=allowed by All_Traffic.src All_Traffic.dest _time

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote is appreciated.
0 Karma

General_Talos
Path Finder

Thanks @scelikok 

@phil_wong 

Please note "_time,source, sourcetype and host" fields in datamodel  are default fields and doesn't require node_name in field-name

To get list of field name available in datamodel use

| datamodel <datamodel_name> search

 

0 Karma

phil_wong
Explorer

Just happend _time is not in the field list. So I was lost my mind.

Thanks for the suggestion!

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...