Splunk Search

how can I query against a time range if i have renamed datetime to _time?

guilmxm
Influencer

Hi,
Thanks you so much for this very great application that opens Splunk to many information system reality!
This App is definitively a must and real well done! i would advise it to anyone.

I am currently developing front ends for my client using Splunk and dbquery to directly works with various data from our databases, still i have an issue with timestamp and i would prefer not to have to locally index these data.

I use the command "rename" to change the datatime column field into "_time" field which works fine to generate timecharts (using timechart command), but this does not allow to filter the search through any timerange or timepicker...this is quite strange as in raw data Splunk seems to recognize the timestamp translated from db format...

Please Would know you do a way to achieve this using dbquery ? Thank you very much for your answer !

Tags (1)
0 Karma
1 Solution

royimad
Builder

I there any simple XML down streaming time range picker values to the search by dbquery?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...