Splunk Search

How to add _time as an attribute in a base search object?

deanilol
Explorer

So I'd like to add the _time attribute to a base search object. As I understand it, I can't use the linear pivot diagram if I don't have _time on the x axis. Now what I want to do is to set _time=(another attribute) so that I can use the linear pivot diagram and choose my own attribute on the x-axis. My problem is that I can't find a way to add the _time as an attribute in the object.

Is there a way to do this without using root Event?

If not, how would I do the same thing using eval expressions in a root event object.

thanks!!

0 Karma

jmallorquin
Builder

Hi,

Have you try the command addinfo?

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Addinfo

Regards,

0 Karma

vganjare
Builder

Hi,

You can use eval to copy the _time value. Something like :

... | eval customTime = _time | ....

Thanks!!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...