Splunk Search

Using Web datamodel _time doesnt show seconds.. the _time is in format of 2020-03-31 08:45:00

dwibedi03
Explorer

I am trying to use tstats to develop a query, however i need _time to be included in the query for the logic to work. but _time doesnt show seconds and it is limiting to minutes only. the Web datamodel that i am using is accelerated. 2020-03-31 08:45:00, this is the timeformat for _time when using tstats.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This question is confusing. _time is in epoch form, which is a count of seconds. The timestamp format cited specifies seconds (08:45:00). So there is no obvious reason why seconds are not available.
Please share your query.

---
If this reply helps you, Karma would be appreciated.
0 Karma

dwibedi03
Explorer

| tstats values(Web.user_bunit) as user_bunit values(Web.src_bunit) as src_bunit values(Web.src) as src_ip values(Web.http_referrer) as http_referrer values(Web.url) as URL values(Web.category) as category values(Web.url_extension) as url_extension1 from datamodel=Web where Web.http_method=GET AND (Web.url_extension="php" OR Web.url_extension="html" OR Web.url_extension="js") by _time Web.user

here, _time truncates the seconds in the query. I tried using strftime to show seconds it didnt work.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...