Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: how to use a field as timestamp for a timechar...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello
I have events similar to:
2014-07-16 9:40:20 msg="hello" time="2014-07-16 9:40:20"
2014-07-16 10:45:20 msg="world" time="2014-07-16 03:45:20"
The first timestamp is used for indexing (which is OK for most of the cases) but I would like to use the content of the field time to build a specific timechart. How can I instruct splunk to do so?
Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk uses the _time field for timecharting. You can eval the value of _time to another value and timechart by it.
Try this if your time field is indexed as a string:
Fixing type with this query. Current version would cause search to fail
... your base search ... | eval NewTime=strptime(time,"%Y-%m-%d %H:%M:%S") | eval _time=NewTime | timechart count
Or this if your time field is indexed as a timestamp:
... your base search ... | eval _time=time | timechart count
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this
your base search | eval _time=strptime(time,"%Y-%m-%d %H:%M:%S") | timechart .....
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk uses the _time field for timecharting. You can eval the value of _time to another value and timechart by it.
Try this if your time field is indexed as a string:
Fixing type with this query. Current version would cause search to fail
... your base search ... | eval NewTime=strptime(time,"%Y-%m-%d %H:%M:%S") | eval _time=NewTime | timechart count
Or this if your time field is indexed as a timestamp:
... your base search ... | eval _time=time | timechart count
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks. Shouldn't the first search be without eval _time=NewTime?
Splunk Observability for AI
Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...
Splunk Observability as Code: From Zero to Dashboard
