Knowledge Management

How can I set KV store collection data for data type time, when using the REST API?

danrb1978
New Member

I am having trouble setting the value of a KV Store collection field of type time. Does anyone know the best way to do this through the REST API?

Some additional detail,

I have a KV Store collection, created through the REST API, which contains the following fields, with these types.

<s:key name="field.customerId">string</s:key>
<s:key name="field.notes">string</s:key>
<s:key name="field.expiration">time</s:key>

Next, I do a POST to my collection, with the following data:
{
"customerId":"123456",
"notes":"Expiration date should be 6/1/2016",
"expiration":"2016-06-01T12:00:00.000Z"
}

Last, I check the contents of the record:
{
"customerId": "123456",
"notes": "Expiration date should be 6/1/2016"
}

For some reason my expiration field won't persist data. I have taken a few guesses at the format required for my time field in the POST above, but have not had any success storing a value.

0 Karma

shaskell_splunk
Splunk Employee
Splunk Employee

You need to use a valid BSON data type and 'time' is not valid. Have a look at these two and see if either work.

https://docs.mongodb.org/manual/reference/bson-types/#date

https://docs.mongodb.org/manual/reference/bson-types/#timestamps

I believe you'll need to convert your date to epoch time as well.

eval epoch=strptime(expiration, "%Y-%m-%dT%H:%M:%S.%3NZ")

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...