Overwrite _time

Splunk Search

Can I overwrite _time with another time from one of the fields in the event?

Turns out you can.

I'm basically doing:

_time = strptime(real_time, "%Y%m%d%H%M%S")

yes you can.

Get Updates on the Splunk Community!

In today’s data-heavy environment, organizations are caught in a data distribution dilemma. As data volumes ...

Streamlining Data Management: Introducing a unified experience in Splunk Managing data at scale shouldn’t feel ...

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Join the Conversation