Splunk Search

can't use a field with special characters in search --> _@timestamp

pavan_injarapu
Explorer

I have a field named '_@timestamp' in my data. When i search for this field, the result doesn't show up. May be because this is being treated as an internal field by Splunk. How to query for this field?

index::<> | fields _@timestamp time

Fields section resulted from 'search' only has time field but not _@timestamp

0 Karma

to4kawa
Ultra Champion
|makeresults
| eval "_@timestamp"=now()
| eval time='_@timestamp'
| rename "_@timestamp" as visible_time

hi @pavan_injarapu
That's a great field name.

0 Karma

adonio
Ultra Champion

try something like this:
index::<yourindexhere> | fields _@timestamp time | eval time2 = _@timestamp

0 Karma

pavan_injarapu
Explorer

Thanks for the response Adonio, its not working

0 Karma

adonio
Ultra Champion

switch it then:
index:: | eval time2 = _@timestamp| fields time2 time

0 Karma

pavan_injarapu
Explorer

I tried all such combinations already 🙂

0 Karma

Vijeta
Influencer

May be the field is not parsed or extracted , its part of raw event only. In order to use it you need to create a field extraction. Can you share some sample log please.

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...