Splunk Search

Time part is discarding

sheshanath
Loves-to-Learn Lots

I have a timestamp variable  EmailSendAt=2020-07-15 05:52:13.186 , 

Whenever I am using
stats value(EmailSendAt) as time..

It shows me only Date part.. Time part is discarding. (I used table also but no change happen)

Labels (1)
0 Karma

to4kawa
Ultra Champion
index=_internal |head 1| fields _raw _time 
| eval _raw="EmailSendAt=2020-07-15 05:52:13.186 , "
| rename COMMENT as "the logic"
| kv

your fields extractions is wrong. try kv

0 Karma

sheshanath
Loves-to-Learn Lots

EmailSendAt is a field and whenever I pull this field with by 

stats values(EmailSendAt) as time .... it shows only date part.

 

For example suppose 

EmailSendAt=2020-07-15 05:52:13.186

then using  stats values(EmailSendAt) as time  only shows me date part. Please help

.

Thanks 

0 Karma

to4kawa
Ultra Champion

try kv before stats

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...