Splunk Search

Set Custom time as _time

kpavan
Path Finder

Hi All,

I have requirement like we have custom time field ALERTDATETIME i want to display graph where my custom time field should be primary time field. This could have been easy if they asked just display ALERTDATETIME stats but they want time filter in graph where if they select last 7days or expanding to 30 days the data should be displayed based on ALERTDATETIME not the _time field. So am stuck here how to set custom time field as _time when user filtering date.

The date format of ALERTDATETIME is "%Y-%m-%d %H:%M:%S", need to convert only %Y-%m-%d. I tried something like below query but didn't work.

base search
| eval _time=strptime(ALERTDATETIME,"%Y-%m-%d")
| stats count by _time

Thanks!
Pavan

0 Karma

cmerriman
Super Champion

try using this:

base search
| addinfo 
| eval _time=strptime(ALERTDATETIME,"%Y-%m-%d") 
| where _time>=info_min_time AND (info_max_time="+Infinity" OR _time<=info_max_time)
| stats count by _time

that should allow for use of the time picker.

0 Karma

micahkemp
Champion

When the user searches for, say, 7 days, do they expect that search to return results where ALERTDATETIME is within that 7 day window, or do they only want the resulting output to make use of ALERTDATETIME?

0 Karma

kpavan
Path Finder

Hi Micahkemp

Thanks for reply!

They want to When the user searches for, say, 7 days, do they expect that search to return results where ALERTDATETIME is within that 7 day window

Thanks!

0 Karma

micahkemp
Champion

In that case you need to ensure the timepicker range selected encompasses the full time range of the actual _time field that may have events with ALERTDATETIME in the desired range. That may mean users can't select 7 days from the timepicker if they want 7 days based on ALERTDATETIME.

The timepicker will only define your time window based on _time.

0 Karma

p_gurav
Champion

Hi kpavan,

Please try following link:
link text

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...