Getting Data In

Can you answer my fundamental question about the date time picker?

mumblingsages
Path Finder

I have a fundamental question regarding dealing with multiple dates per log message. Below is a typical log that I've ingested (as part of a historical data load) and I'm allowing Splunk to assign _time to the time that this record is ingested.

alt text

The reason I allowed it to index _time it was ingested is because each of these times are equally valid for querying against. This obviously leads to issues with utilizing the date/time picker as it only looks at the _time field.

I have to believe others have dealt with this, so I'm wondering what the best practice is? Do people create separate indexes for this? I think I saw some individuals using different source types, which, in this case, I don't think would make sense. I've seen some references to creating transactions for dealing with this scenario too. Really appreciate any advice on how to appropriately handle this.

0 Karma

mumblingsages
Path Finder

I might have answered my own question as the following seems to work.

index="myindex"
| addinfo
| eval createdEpoch = strptime(dateCreated, "%Y-%m-%dT%T")
| where createdEpoch >= info_min_time
0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...