Splunk Search

how to use a field as timestamp for a timechart

wojtek_swiatek
Path Finder

Hello

I have events similar to:

2014-07-16 9:40:20 msg="hello" time="2014-07-16 9:40:20"
2014-07-16 10:45:20 msg="world" time="2014-07-16 03:45:20"

The first timestamp is used for indexing (which is OK for most of the cases) but I would like to use the content of the field time to build a specific timechart. How can I instruct splunk to do so?

Thank you!

Tags (2)
1 Solution

wpreston
Motivator

Splunk uses the _time field for timecharting. You can eval the value of _time to another value and timechart by it.

Try this if your time field is indexed as a string:
Fixing type with this query. Current version would cause search to fail

... your base search ... | eval NewTime=strptime(time,"%Y-%m-%d %H:%M:%S") | eval _time=NewTime | timechart count

Or this if your time field is indexed as a timestamp:

... your base search ... | eval _time=time | timechart count

View solution in original post

somesoni2
Revered Legend

Try this

your base search | eval _time=strptime(time,"%Y-%m-%d %H:%M:%S") | timechart .....

wpreston
Motivator

Splunk uses the _time field for timecharting. You can eval the value of _time to another value and timechart by it.

Try this if your time field is indexed as a string:
Fixing type with this query. Current version would cause search to fail

... your base search ... | eval NewTime=strptime(time,"%Y-%m-%d %H:%M:%S") | eval _time=NewTime | timechart count

Or this if your time field is indexed as a timestamp:

... your base search ... | eval _time=time | timechart count

wojtek_swiatek
Path Finder

Thanks. Shouldn't the first search be without eval _time=NewTime?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...