Splunk Search

Splunk.intersplunk: Receiving error "could not locate the time (_time) field..."

santosm
New Member

How come I can't locate the time (_time) field on some results returned from the external search command?

Hi,

I use Splunk.Intersplunk library to do my search command, but sometimes output receives the error:
"could not locate the time (_time) field on some results returned from the external search command".

Does anyone know why this is happening?

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hello @santosm,

Recently I came across this issue and I found out that if you use your command as streaming command you need to return _time field. So you can get this field from results streamed to the command and returned with other fields.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...