Splunk Search

how to use a field as timestamp with epoch time for a timechart

Ralf
Explorer

Hi there,

I did already several trials with search commands like "eval _time=strptime(time,"%Y-%m-%dT%H:%M:%S")"
but was not able to manage that time chart is using my own timestamp in the message uploaded.

The data has originally same _time as the upload is done by bulk upload of a log file that contains then several events with there own timestamp in the format:  time: 2020-11-16T15:15:51.113394 

I'd like to show cpu_percentage over my own time stamp.

Hope somebody can help out here

Ralf

 

image.png

Labels (1)
Tags (1)
0 Karma

Ralf
Explorer

yes,    time: 2020-11-16T15:15:51.113394.   is part of my event

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Has time been successfully extracted from your events?

0 Karma

Ralf
Explorer

sorry, what do you mean by "extracted" ?

What I can see, please see also the screen dump on my question is, that the time field in the message show a different time than Splunk time.

That I would say can be expected as Splunk recognize the time of uploading

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you expand the event

ITWhisperer_0-1605612595431.png

Do you see time (as well as _time) as a field?

0 Karma

Ralf
Explorer

looks like this:

Ralf_0-1605615486950.png

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The eval you mentioned should work so long as you do it before the timechart. What do you get if you do the eval and then expand the event as before - does _time = time?

0 Karma

Ralf
Explorer
 

 

original message looks like this:

Ralf_0-1605617721844.png

after trying with this eval command: - don't know if it is 100% correct

eval _time=strptime(time,"%Y-%m-%d %H:%M:%S.%Q")

it looks like this

 image.png

 

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like the eval worked - so timechart should now work as it uses _time

0 Karma

Ralf
Explorer

unfortunately not:

everything looks empty even when I saw the events are there

Ralf_0-1605618870626.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Interesting picture.  You are doing a timechart using values. If you look at the statistics, you will probably see a multivalue field values(cpu_percentage) against each time bucket (quarter of an hour). This cannot be visualised in this way. What is it you are trying to achieve?

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...