How to specify the x axis on the timeline?

[cooperuk]

I have imported a file which has more than one time and date field, splunk is using one of them, however I would like to specify the other time field in the file?

I have been playing around with splunk for a while and have not found an easy way to do it?

Any help would be appreciated.

Cheers

[southeringtonp · Accepted solution]

Assuming your alternate timestamp is already being extracted into a field named EventTime, then you can use eval to replace the original value of the _time field:

| eval _time=EventTime

If you don't have a field extraction set up, you can also use rex to extract the alternate timestamp from _raw into _time.

Be aware that your timestamp needs to be a valid Unix epoch time to work. If your data shows the time in text format, you'll need to convert it first. The exact parameters will vary based on the format. For a date of the form 2010-10-26 14:50:58, you would need:

| eval _time=strptime(EventTime, "%Y-%m-%d %H:%M:%S")

If you are always going to want this timestamp instead of the one that Splunk is extracting automatically, take a look at http://www.splunk.com/base/Documentation/4.1.5/Admin/ConfigurePositionalTimestampExtraction for information on how to modify Splunk's default timestamp recognition.

[southeringtonp]

The date is being extracted in text form, but Splunk needs it in unix epoch time. You will need to convert it - see edits above.

[cooperuk]

*ignore that log.log is a diff file from threatlog.log

Also, sorry I didn’t realise it would takeout the formatting!

[cooperuk]

Thanks for the quick reply.

I have tried the following as a search:
source="c:\Log.log" | rex field=_raw "EventTime: (?.*)" | eval _time="EventTime"

and also I have tried:
source="c:\ThreatLog.log" | eval _time="EventTime"

When I run either of these it says there are 21 things found but does not display anything on the time line and does not list anything below, any ideas?

The first line of the log file is:

2010-10-27 11:45:11 syslogsvc INFO: EventID=1; EventTime=2010-10-26 14:50:58; and some other stuff....

I would like to use EventTime as _time