Is it possible to set the _time field to have the value of another time field in my data?

[ddrillic]

We have the following -

logTime 2016-04-06 06:12:32,251 UTC
eventStartTime 2016-04-06 01:12:32.177
_time 2016-04-06T01:12:32.251-05:00

Is it possible to set the _time field to have the value of eventStartTime?

[lguinn2 · Accepted solution]

If eventStartTime appears in the data, you can use props.conf to use that field as the timestamp at parsing time.
Check out the documentation: Configure timestamp recognition

[somesoni2]

Please note that this is index-time configuration/activity and will only be applicable for any future data that you ingest after you make the changes. Already existing data would not get affected.

[ddrillic]

Perfect. Is there a way, by any chance, to do it on the fly, meaning at search time?

[somesoni2]

You can change the _time to have values from field eventStartTime , at search time like this, but note that the time range will still apply from the older value of _time.

your base search | eval _time=strptime(eventStartTime,"%Y-%m-%d %H:%M:%S.%N")

[thdose]

Is there no way to have the timepicker (including ranges) work when assigning _time to custom a field?

[ddrillic]

Gorgeous !!!!