Splunk Search

Why time filter value/range is not being passed to the query result?

chongdong
Explorer

Does anyone know why the time range picker here on the right side (set to Yesterday Jan 30) cannot affect my _time data field in the query result? How to link them? 

chongdong_0-1675219422905.png

 

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

That's because you re-evaluated _time in the third line shown in the screenshot to "created_at".

| eval _time = created_at

You data may have collected these events from Jan 30, but the field "created" has different values

0 Karma

chongdong
Explorer

Got it. Thanks for the explanation. So is there a way to modify the time filter to point to my timestamp which is created_at? 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Yes.  if you don't like your current _time at all, you can change your ingestion to use created_at as _time. (This is perhaps not the correct solution in most cases.)

At search time, you can use calculated field to calculate epoch time from created_at and name it _time.

0 Karma
Get Updates on the Splunk Community!

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

The Great Resilience Quest: 9th Leaderboard Update

The ninth leaderboard update (11.9-11.22) for The Great Resilience Quest is out >> Kudos to all the ...