Splunk Search

web event start time, splunk record time and endtime in http stream data

cyberfan
Explorer

Given free sample http stream data download from splunk website. I got two questions with start time, record time and endtime.

(1). is "_time" the recorded time by splunk index?  how to output as "H:MM:SS" format. and "HH:MM:SS" format respectfully?  example, 18:27.36.257, HH:MM:SS will be 18:27:36, H:MM:SS will be 6:27:36

(2), say, user enter hacker.com/a.js in chrome at 18:27:36, at 18:27:50, a.js start loading,  18:28:59, a.js finished execution, would splunk index capture start time, record time, endtime? what are the fields? thanks

Labels (2)
0 Karma

dpitts007
Loves-to-Learn Lots

Please post the URL for the sample data you are referring to.

(1) Essentially _time should represent the time included within the raw audit event (when it can be determined):
https://docs.splunk.com/Documentation/Splunk/6.4.0/Data/HowSplunkextractstimestamps

You can convert _time as "H:MM:SS" format:
index=* | eval t=strftime(_time, "%I:%M:%S") | table _time, t

You can convert _time as "HH:MM:SS" format:
index=* | eval t=strftime(_time, "%H:%M:%S") | table _time, t

https://docs.splunk.com/Documentation/Splunk/8.0.6/SearchReference/Commontimeformatvariables

Leave off the trailing pipe into table once you have confirmed that is what you wanted.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...