Splunk Search

Why do some entries (of type search) have api_et, api_lt, and others have apiStartTime,apiEndTime?

jason0
Path Finder

Hello,

I am digging through my _audit index to see what searches people are running over time, but I am confused by the following fields.

  1. api_et , api_It
  2. apiStartTime, apiEndTime

It would appear that api_et and apiEndTime are the same thing.  same with api_lt, and api_StartTime.   I get that api_(el)t are epoch times, and the others are formatted dates.

Why do some entries (of type search) have api_et, api_lt, and others have apiStartTime,apiEndTime?  Thus far I have to do any calculations based on the presence of both sets and use coalesce to choose between the one that's not bogus.

--jason

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jason0,

I don't know why there's this behaviour, this i a question for Splunk Project Team, but anyway, you already identified the solution: use coalesce to be sure to have a value for calculations.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jason0,

I don't know why there's this behaviour, this i a question for Splunk Project Team, but anyway, you already identified the solution: use coalesce to be sure to have a value for calculations.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jason0 

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

jason0
Path Finder

Thanks Guiseppe, I appreciate your response.  It helps me a lot!

 

--jason

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...