Splunk Search
Highlighted

How to search within a timestamp that isn't _time?

Path Finder

Hi guys,

I'm trying to search within events on a specific day using a timestamp that is not _time and I also want to use the time picker values.

index=base search... | eval _time=strptime(NEWTIMESTAMP,"%Y-%m-%dT%H:%M:%SZ") | timechart count | where strptime(NEWTIMESTAMP,"%Y-%m-%dT%H:%M:%SZ") < $latest$

You can see I'm changing the NEWTIMESTAMP to _time so I can use it in the timechart. The problem is it is not applying the time set in the picker and it's just displaying all the results.

At what stage is the timepicker applied to the pipe?

How to I reference the timepicker?

0 Karma
Highlighted

Re: How to search within a timestamp that isn't _time?

Splunk Employee
Splunk Employee

You can use the addinfo command to get the earliest epoch time infomintime and latest epoch time infomaxtime for that search. If NEWTIMESTAMP is epoch ...

index=base search... |  timechart count | where ((NEWTIMESTAMP < info_max_time) AND (NEWTIMESTAMP > info_min_time))

Otherwise you can first use convert or eval to translate NEWTIMESTAMP to epoch. Bonus: eval & where share same functions, so you can actually do the conversion from within the comparison.

View solution in original post

Highlighted

Re: How to search within a timestamp that isn't _time?

Path Finder

Thanks buddy,

Got it working with this:

index=base search | addinfo | eval NEWTS1=strptime(NEWTIMESTAMP,"%Y-%m-%dT%H:%M:%SZ")  |   where ((NEWTS1 < info_max_time) AND (NEWTS1 > info_min_time)) 
Highlighted

Re: How to search within a timestamp that isn't _time?

Explorer

Hello,
I am struggling with the same question. I am trying to use a timestamp that is NOT time. My time stamp is TransactionDate. I am facing the same issue. When I click the small magnifying glass near the timepicker in the seach command, I am getting all results , which means it picking _time and Not Transaction date. I tried all the below commands and still not working. can you please help.

index=base search... | where ((NEWTIMESTAMP < info_max_time) AND (NEWTIMESTAMP > info_min_time))

index=base search | addinfo | eval NEWTS1=strptime(Transaction_Date,"%Y-%m-%dT%H:%M:%S.%N")  |   where ((NEWTS1 < info_max_time) AND (NEWTS1 > info_min_time)) 

I just want the magnifying glass to pick Transaction_Date timestamp.

0 Karma