Splunk Search

Using Web datamodel _time doesnt show seconds.. the _time is in format of 2020-03-31 08:45:00

dwibedi03
Explorer

I am trying to use tstats to develop a query, however i need _time to be included in the query for the logic to work. but _time doesnt show seconds and it is limiting to minutes only. the Web datamodel that i am using is accelerated. 2020-03-31 08:45:00, this is the timeformat for _time when using tstats.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This question is confusing. _time is in epoch form, which is a count of seconds. The timestamp format cited specifies seconds (08:45:00). So there is no obvious reason why seconds are not available.
Please share your query.

---
If this reply helps you, Karma would be appreciated.
0 Karma

dwibedi03
Explorer

| tstats values(Web.user_bunit) as user_bunit values(Web.src_bunit) as src_bunit values(Web.src) as src_ip values(Web.http_referrer) as http_referrer values(Web.url) as URL values(Web.category) as category values(Web.url_extension) as url_extension1 from datamodel=Web where Web.http_method=GET AND (Web.url_extension="php" OR Web.url_extension="html" OR Web.url_extension="js") by _time Web.user

here, _time truncates the seconds in the query. I tried using strftime to show seconds it didnt work.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...