Splunk Search

Unable to extract Time in search results

Explorer

Hi All,

I have proper timestamp logs in Splunk. I am able to extract time for all the searches except one.

index =mtp | stats count by Activity user

when i need count for these two fields, i am getting the result but not Time.

Can someone please suggest.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

The stats command discards all fields except those used in the command itself. In your example, only 'count', 'Activity', and 'user' will be available for use after stats. Depending on how you intend to use Time, try one of stats count, values(_time) as Time by Activity, user or stats count, latest(_time) as Time by Activity, user.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

The stats command discards all fields except those used in the command itself. In your example, only 'count', 'Activity', and 'user' will be available for use after stats. Depending on how you intend to use Time, try one of stats count, values(_time) as Time by Activity, user or stats count, latest(_time) as Time by Activity, user.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Explorer

Hey Thanks it worked but i am getting time in below format.

Activity
user
count
Time
accueil AD161 2 1585034778.911
accueil DRA4D 4 1584974193.304

0 Karma

Explorer

I am able to do so with below command

eval time=strftime(Time,"%m/%d/%y")

0 Karma