Splunk Search

Why time filter value/range is not being passed to the query result?

chongdong
Explorer

Does anyone know why the time range picker here on the right side (set to Yesterday Jan 30) cannot affect my _time data field in the query result? How to link them? 

chongdong_0-1675219422905.png

 

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

That's because you re-evaluated _time in the third line shown in the screenshot to "created_at".

| eval _time = created_at

You data may have collected these events from Jan 30, but the field "created" has different values

0 Karma

chongdong
Explorer

Got it. Thanks for the explanation. So is there a way to modify the time filter to point to my timestamp which is created_at? 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Yes.  if you don't like your current _time at all, you can change your ingestion to use created_at as _time. (This is perhaps not the correct solution in most cases.)

At search time, you can use calculated field to calculate epoch time from created_at and name it _time.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...