Splunk Search

How to get event _time from CIM data model?

phil_wong
Explorer

I checked CIM data models have inherited _time but I couldn't retrieve. 

Anyone can tell what's wrong? 

| tstats summariesonly=true allow_old_summaries=true count from datamodel=Network_Traffic.All_Traffic where All_Traffic.action=allowed by All_Traffic.src All_Traffic.dest All_Traffic._time

Labels (1)
Tags (2)
0 Karma
1 Solution

General_Talos
Path Finder

Thanks @scelikok 

@phil_wong 

Please note "_time,source, sourcetype and host" fields in datamodel  are default fields and doesn't require node_name in field-name

To get list of field name available in datamodel use

| datamodel <datamodel_name> search

 

View solution in original post

0 Karma

scelikok
Champion

Hi @phil_wong,

Metadata field are accessible without node name. You should use _time like below;

| tstats summariesonly=true allow_old_summaries=true count from datamodel=Network_Traffic.All_Traffic where All_Traffic.action=allowed by All_Traffic.src All_Traffic.dest _time

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote is appreciated.
0 Karma

General_Talos
Path Finder

Thanks @scelikok 

@phil_wong 

Please note "_time,source, sourcetype and host" fields in datamodel  are default fields and doesn't require node_name in field-name

To get list of field name available in datamodel use

| datamodel <datamodel_name> search

 

View solution in original post

0 Karma

phil_wong
Explorer

Just happend _time is not in the field list. So I was lost my mind.

Thanks for the suggestion!

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!