I wish to keep only _time
and _raw
fields in the export output file. I read in the documentation that | fields - _*
removes all internal fields, but how can i keep only internal specific fields in the output?
Also, when i use table
i get _indextime
and without it, i only see _time
. Why is there a distinction between the fields i see in the same output when table
or fields
is used? The _time
is in "2015-07-06 01:48:09.118 GMT" format whereas _indextime
is in epoch format. How can i convert _time
into equivalent epoch time?
Be aware there are more differences between table and fields then just the stripping away of internal fields. Mainly related to statistically functions and reporting, but do note it can break searches..
http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Table
http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Fields
Use table command when you want to retain data in tabular format. The table command can be used to build a scatter plot to show trends in the relationships between discrete values of your data. Otherwise, you should not use it for charts (such as chart or timechart) because the UI requires the internal fields (which are the fields beginning with an underscore, _*) to render the charts, and the table command strips these fields out of the results by default. Instead, you should use the fields command because it always retains all the internal fields.
Hi karan1337,
you can this run everywhere search:
index=_internal | table _time _raw
and will only get _time
and _raw
in the output. _time
is always epoch, but the UI will convert it to human readable time.
The distinction between the table
and fields
is that, table
only keeps the provided fields where as fields
keeps the internal fields as well.
Hope that helps ...
cheers, MuS
@MuS What is index=_internal?
This is Splunk's internal index, see docs http://docs.splunk.com/Documentation/Splunk/6.2.3/Troubleshooting/WhatSplunklogsaboutitself
_internal is the Splunk internal indexed, used for internal logging of metrics, errors, logins, search history, etc.