can't use a field with special characters in search --> _@timestamp

[pavan_injarapu]

I have a field named '_@timestamp' in my data. When i search for this field, the result doesn't show up. May be because this is being treated as an internal field by Splunk. How to query for this field?

index::<> | fields _@timestamp time

Fields section resulted from 'search' only has time field but not _@timestamp

[to4kawa]

|makeresults
| eval "_@timestamp"=now()
| eval time='_@timestamp'
| rename "_@timestamp" as visible_time

hi @pavan_injarapu
That's a great field name.

[adonio]

try something like this:
index::<yourindexhere> | fields _@timestamp time | eval time2 = _@timestamp

[pavan_injarapu]

Thanks for the response Adonio, its not working

[adonio]

switch it then:
index:: | eval time2 = _@timestamp| fields time2 time

[pavan_injarapu]

I tried all such combinations already 🙂

[Vijeta]

May be the field is not parsed or extracted , its part of raw event only. In order to use it you need to create a field extraction. Can you share some sample log please.