Splunk Search

Unable to extract Time in search results

ramprakash
Explorer

Hi All,

I have proper timestamp logs in Splunk. I am able to extract time for all the searches except one.

index =mtp | stats count by Activity user

when i need count for these two fields, i am getting the result but not Time.

Can someone please suggest.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The stats command discards all fields except those used in the command itself. In your example, only 'count', 'Activity', and 'user' will be available for use after stats. Depending on how you intend to use Time, try one of stats count, values(_time) as Time by Activity, user or stats count, latest(_time) as Time by Activity, user.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The stats command discards all fields except those used in the command itself. In your example, only 'count', 'Activity', and 'user' will be available for use after stats. Depending on how you intend to use Time, try one of stats count, values(_time) as Time by Activity, user or stats count, latest(_time) as Time by Activity, user.

---
If this reply helps you, Karma would be appreciated.
0 Karma

ramprakash
Explorer

Hey Thanks it worked but i am getting time in below format.

Activity
user
count
Time
accueil AD161 2 1585034778.911
accueil DRA4D 4 1584974193.304

0 Karma

ramprakash
Explorer

I am able to do so with below command

eval time=strftime(Time,"%m/%d/%y")

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...