Splunk Search

Why do some entries (of type search) have api_et, api_lt, and others have apiStartTime,apiEndTime?

jason0
Engager

Hello,

I am digging through my _audit index to see what searches people are running over time, but I am confused by the following fields.

  1. api_et , api_It
  2. apiStartTime, apiEndTime

It would appear that api_et and apiEndTime are the same thing.  same with api_lt, and api_StartTime.   I get that api_(el)t are epoch times, and the others are formatted dates.

Why do some entries (of type search) have api_et, api_lt, and others have apiStartTime,apiEndTime?  Thus far I have to do any calculations based on the presence of both sets and use coalesce to choose between the one that's not bogus.

--jason

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
Legend

Hi @jason0,

I don't know why there's this behaviour, this i a question for Splunk Project Team, but anyway, you already identified the solution: use coalesce to be sure to have a value for calculations.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
Legend

Hi @jason0,

I don't know why there's this behaviour, this i a question for Splunk Project Team, but anyway, you already identified the solution: use coalesce to be sure to have a value for calculations.

Ciao.

Giuseppe

0 Karma

gcusello
Legend

Hi @jason0 

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

jason0
Engager

Thanks Guiseppe, I appreciate your response.  It helps me a lot!

 

--jason

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...