Splunk Search

can't use a field with special characters in search --> _@timestamp

pavan_injarapu
Explorer

I have a field named '_@timestamp' in my data. When i search for this field, the result doesn't show up. May be because this is being treated as an internal field by Splunk. How to query for this field?

index::<> | fields _@timestamp time

Fields section resulted from 'search' only has time field but not _@timestamp

0 Karma

to4kawa
Ultra Champion
|makeresults
| eval "_@timestamp"=now()
| eval time='_@timestamp'
| rename "_@timestamp" as visible_time

hi @pavan_injarapu
That's a great field name.

0 Karma

adonio
Ultra Champion

try something like this:
index::<yourindexhere> | fields _@timestamp time | eval time2 = _@timestamp

0 Karma

pavan_injarapu
Explorer

Thanks for the response Adonio, its not working

0 Karma

adonio
Ultra Champion

switch it then:
index:: | eval time2 = _@timestamp| fields time2 time

0 Karma

pavan_injarapu
Explorer

I tried all such combinations already 🙂

0 Karma

Vijeta
Influencer

May be the field is not parsed or extracted , its part of raw event only. In order to use it you need to create a field extraction. Can you share some sample log please.

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...