Splunk Search

can't use a field with special characters in search --> _@timestamp

pavan_injarapu
Explorer

I have a field named '_@timestamp' in my data. When i search for this field, the result doesn't show up. May be because this is being treated as an internal field by Splunk. How to query for this field?

index::<> | fields _@timestamp time

Fields section resulted from 'search' only has time field but not _@timestamp

0 Karma

to4kawa
Ultra Champion
|makeresults
| eval "_@timestamp"=now()
| eval time='_@timestamp'
| rename "_@timestamp" as visible_time

hi @pavan_injarapu
That's a great field name.

0 Karma

adonio
Ultra Champion

try something like this:
index::<yourindexhere> | fields _@timestamp time | eval time2 = _@timestamp

0 Karma

pavan_injarapu
Explorer

Thanks for the response Adonio, its not working

0 Karma

adonio
Ultra Champion

switch it then:
index:: | eval time2 = _@timestamp| fields time2 time

0 Karma

pavan_injarapu
Explorer

I tried all such combinations already 🙂

0 Karma

Vijeta
Influencer

May be the field is not parsed or extracted , its part of raw event only. In order to use it you need to create a field extraction. Can you share some sample log please.

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...