Splunk Search

Why time filter value/range is not being passed to the query result?

chongdong
Explorer

Does anyone know why the time range picker here on the right side (set to Yesterday Jan 30) cannot affect my _time data field in the query result? How to link them? 

chongdong_0-1675219422905.png

 

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

That's because you re-evaluated _time in the third line shown in the screenshot to "created_at".

| eval _time = created_at

You data may have collected these events from Jan 30, but the field "created" has different values

0 Karma

chongdong
Explorer

Got it. Thanks for the explanation. So is there a way to modify the time filter to point to my timestamp which is created_at? 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Yes.  if you don't like your current _time at all, you can change your ingestion to use created_at as _time. (This is perhaps not the correct solution in most cases.)

At search time, you can use calculated field to calculate epoch time from created_at and name it _time.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...