timechart for a time described in log file

[linu1988]

Hello,
i would like to know how can i draw a timechart using the log timestamps instead of the event timeStamp.

e.g. my log contains the list of events having its own timestamp. while monitoring the folder it will come in bulk which is not suitable for the timechart.

Any help or insight to the solution is much appreciated. Thank you all.

[Lucas_K]

You can also do it on the fly by reassigning the _time field to any other extracted or evaled time field. But it would be best to fix your original time stamps unless they are already used for something else.

[Lucas_K]

Extract your time field (rex it or however) and then eval it to the _time value.

ie. eval _time=new_time_field

That is all there is to it. You may also need to play with the actual value if it is not in a time format that splunk natively understands.

Reassignment of the _time value is also how you can fold time series together. An example of this might be comparing last weeks events to this weeks events all on a single overlaping timechart (answers example here : http://splunk-base.splunk.com/answers/2712/line-chart-comparing-yesterdays-result-with-todays-result... )

[linu1988]

I could find the ways to extract the time-stamp fields/transform. But i am unable to think how do i assign it to actual event timings? Then use them to draw charts. Need assistance..

[Ayn]

This is a good place to start. http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Configuretimestamprecognition

[linu1988]

Any hint how can i achieve that?

[Ayn]

The best thing would probably be to configure your timestamp recognition so that the event's timestamp IS the log's timestamp.