Splunk Search

How to write a search for a specific timestamp?

Mubarish
Path Finder

Hi,
I have my search query which returns a table. In the table, Timestamp is one of my field. Format of the Timestamp field is YYYY/MM/DD HH:MM:SS (i.e) Date(Space)Time
For example
2014/07/10 03:17:44
2014/07/10 03:17:14 etc.
I want to search Timestamp suppose
for example basequery... | search Timestamp = 2014/07/10 03:17:44 , the record with that particular date&time has to display. Since there is a space between date and time, my search shows no result found. How can I search for a specific timestamp?

Tags (2)
0 Karma

somesoni2
Revered Legend

Your logs in Splunk should have _time field in epoch format. You can convert your token value to epoch and compare against _time value.

your base search _time=[|gentimes start=-1 | eval search=strptime("YourDateValue","%Y/%m/%d %H:%M:%S" | table search]

0 Karma

MuS
Legend

Hi Mubarish,

simply use double quotes around the value like in this run everywhere search command (you must be able to search index=_internal) :

 index=_internal "[19/Aug/2014:15* +0200]"

This will show all event from today (as it is the 19th of August 2014) 3pm

hope this helps ...

cheers, MuS

pradeepkumarg
Influencer

Did you try this?

basequery| search Timestamp = "2014/07/10 03:17:44"

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...