Splunk Search

how to use a field as timestamp for a timechart

wojtek_swiatek
Path Finder

Hello

I have events similar to:

2014-07-16 9:40:20 msg="hello" time="2014-07-16 9:40:20"
2014-07-16 10:45:20 msg="world" time="2014-07-16 03:45:20"

The first timestamp is used for indexing (which is OK for most of the cases) but I would like to use the content of the field time to build a specific timechart. How can I instruct splunk to do so?

Thank you!

Tags (2)
1 Solution

wpreston
Motivator

Splunk uses the _time field for timecharting. You can eval the value of _time to another value and timechart by it.

Try this if your time field is indexed as a string:
Fixing type with this query. Current version would cause search to fail

... your base search ... | eval NewTime=strptime(time,"%Y-%m-%d %H:%M:%S") | eval _time=NewTime | timechart count

Or this if your time field is indexed as a timestamp:

... your base search ... | eval _time=time | timechart count

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try this

your base search | eval _time=strptime(time,"%Y-%m-%d %H:%M:%S") | timechart .....

wpreston
Motivator

Splunk uses the _time field for timecharting. You can eval the value of _time to another value and timechart by it.

Try this if your time field is indexed as a string:
Fixing type with this query. Current version would cause search to fail

... your base search ... | eval NewTime=strptime(time,"%Y-%m-%d %H:%M:%S") | eval _time=NewTime | timechart count

Or this if your time field is indexed as a timestamp:

... your base search ... | eval _time=time | timechart count

wojtek_swiatek
Path Finder

Thanks. Shouldn't the first search be without eval _time=NewTime?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...