Splunk Search

Is it possible to set the _time field to have the value of another time field in my data?

ddrillic
Ultra Champion

We have the following -

logTime 2016-04-06 06:12:32,251 UTC
eventStartTime 2016-04-06 01:12:32.177
_time 2016-04-06T01:12:32.251-05:00

Is it possible to set the _time field to have the value of eventStartTime?

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

If eventStartTime appears in the data, you can use props.conf to use that field as the timestamp at parsing time.
Check out the documentation: Configure timestamp recognition

View solution in original post

lguinn2
Legend

If eventStartTime appears in the data, you can use props.conf to use that field as the timestamp at parsing time.
Check out the documentation: Configure timestamp recognition

somesoni2
SplunkTrust
SplunkTrust

Please note that this is index-time configuration/activity and will only be applicable for any future data that you ingest after you make the changes. Already existing data would not get affected.

0 Karma

ddrillic
Ultra Champion

Perfect. Is there a way, by any chance, to do it on the fly, meaning at search time?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can change the _time to have values from field eventStartTime , at search time like this, but note that the time range will still apply from the older value of _time.

your base search | eval _time=strptime(eventStartTime,"%Y-%m-%d %H:%M:%S.%N")

thdose
New Member

Is there no way to have the timepicker (including ranges) work when assigning _time to custom a field?

0 Karma

ddrillic
Ultra Champion

Gorgeous !!!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...