Splunk Search

Why does tstats command alter time stamps when I run it by _time?

LIS
Path Finder

I am wondering why tstats command alters time stamps when I run it by _time.

| tstats values(text_len) as text_len  values(ts) as ts where index = data sourcetype = cdr by _time thread_id num_attempts

raw data in index=data :  

Time   _time 2023-03-22T13:14:16.000+01:00

 

LIS_0-1679491403739.png

After tstats:

2023-03-22 13:10:00

LIS_1-1679491530559.png

 

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

To group events by _time, tstats rounds the _time value down to create groups based on the specified span.  If no span is specified, tstats will pick one that fits best in the time window search - 10 minutes in this case.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

To group events by _time, tstats rounds the _time value down to create groups based on the specified span.  If no span is specified, tstats will pick one that fits best in the time window search - 10 minutes in this case.

---
If this reply helps you, Karma would be appreciated.

LIS
Path Finder

Hi @richgalloway 

 

Thank you for your response. But in my case there are no groups, because i used also another field (id) in by section, which is unique. So I expected to see all events with their original timestamps.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

tstats by _time supports the span= argument, so you can do span=1s to get the a 1 second bucket of _time

 

yeahnah
Motivator

Hi @LIS 

@richgalloway  is correct, it's due to grouping by the _time field.

If you do want to pull the original _time out of the event then do not group by _time but pull it out as a field value, e.g.

| tstats max(_time) AS _time values(text_len) as text_len  values(ts) as ts where index = data sourcetype = cdr by thread_id num_attempts 

 This assumes that each event has a unique thread_id and num_attempts, but hopefully this demonstrates the difference in what you expected.

richgalloway
SplunkTrust
SplunkTrust

tstats still would have modified the timestamps in anticipation of creating groups.  It wouldn't know that would fail until it was too late.

If this was a stats command then you could copy _time to another field for grouping, but I don't know of a way to do that with tstats.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...