Splunk Search

can't use a field with special characters in search --> _@timestamp

pavan_injarapu
Explorer

I have a field named '_@timestamp' in my data. When i search for this field, the result doesn't show up. May be because this is being treated as an internal field by Splunk. How to query for this field?

index::<> | fields _@timestamp time

Fields section resulted from 'search' only has time field but not _@timestamp

0 Karma

to4kawa
Ultra Champion
|makeresults
| eval "_@timestamp"=now()
| eval time='_@timestamp'
| rename "_@timestamp" as visible_time

hi @pavan_injarapu
That's a great field name.

0 Karma

adonio
Ultra Champion

try something like this:
index::<yourindexhere> | fields _@timestamp time | eval time2 = _@timestamp

0 Karma

pavan_injarapu
Explorer

Thanks for the response Adonio, its not working

0 Karma

adonio
Ultra Champion

switch it then:
index:: | eval time2 = _@timestamp| fields time2 time

0 Karma

pavan_injarapu
Explorer

I tried all such combinations already 🙂

0 Karma

Vijeta
Influencer

May be the field is not parsed or extracted , its part of raw event only. In order to use it you need to create a field extraction. Can you share some sample log please.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...