Splunk Search

Why time filter value/range is not being passed to the query result?

chongdong
Explorer

Does anyone know why the time range picker here on the right side (set to Yesterday Jan 30) cannot affect my _time data field in the query result? How to link them? 

chongdong_0-1675219422905.png

 

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

That's because you re-evaluated _time in the third line shown in the screenshot to "created_at".

| eval _time = created_at

You data may have collected these events from Jan 30, but the field "created" has different values

0 Karma

chongdong
Explorer

Got it. Thanks for the explanation. So is there a way to modify the time filter to point to my timestamp which is created_at? 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Yes.  if you don't like your current _time at all, you can change your ingestion to use created_at as _time. (This is perhaps not the correct solution in most cases.)

At search time, you can use calculated field to calculate epoch time from created_at and name it _time.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...