Splunk Search

Using earliest with custom time field

agh
Explorer

This below query gives me the earliest trigger_name according to the splunk log timestamps. But I have a custom timestamp field called TIMESTAMP_DERIVED which does not match the _time and I want to do my earliest calculation based on that field. Is this possible?

eventtype=sfdc-event-log | stats earliest(TRIGGER_NAME), earliest(TRIGGER_TYPE) by REQUEST_ID 

 

Labels (1)
0 Karma
1 Solution

bowesmana
Super Champion

If you convert the TIMESTAMP_DERIVED to _time then you can do what you are doing, but that will depend on if you still need _time to be present.

Note that the data you search for will only appear in your results if _time is within the time range selected, so even if TIMESTAMP_DERIVED is a time within your search window it will not be found

You can convert TIMESTAMP_DERIVED with

| eval _time=strptime(TIMESTAMP_DERIVED, "_format_specifiers_here")

 

View solution in original post

bowesmana
Super Champion

If you convert the TIMESTAMP_DERIVED to _time then you can do what you are doing, but that will depend on if you still need _time to be present.

Note that the data you search for will only appear in your results if _time is within the time range selected, so even if TIMESTAMP_DERIVED is a time within your search window it will not be found

You can convert TIMESTAMP_DERIVED with

| eval _time=strptime(TIMESTAMP_DERIVED, "_format_specifiers_here")

 

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!