Splunk Search

How to map extracted field name (e.g actual_time) with _time field?


Hi SMEs, I have a unique requirement which need one of my extracted filed name = actual_time to be mapped with _time field. As while searching past 30 days data i am also getting the older data while looking at actual_time field. I think if i map actual_time with _time or by other mean i should be able to get the actual outcome. thanks in advance

Labels (3)
Tags (1)
0 Karma



Try this out to search for a time interval based on the actual_time. 

(your search)
| eval _time=actual_time
| search earliest=<epoch_time> latest=<epoch_time>


If the actual-time is not in epoch, you must convert it before the search command:

| eval _time=strftime(actual_time, "%Y-%m-%d %H:%M:%S")


If this was helpful, some karma would be appreciated.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...