Splunk Search

How can we modify the wrong _raw timestamp for a summary index?

abhijit_mhatre
Path Finder

After populating data under summary index we are getting wrong timestamp for all the fields.

Original search query:
index=ABC sourcetype=XYZ subtype=### earliest=-90d@d latest=now | eval date=strftime(_time, "%m/%d/%Y") | stats count as Incoming, count(eval(action="blocked")) as Blocked by date |collect index=summary_index source="***"

Post Summary index query:
index=summary_index source="***"

However, when i run the above query, I lose the actual timestamp of the event. Instead, all events in the summary index have the current system time as the timestamp.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Change the Original Search like this

index=ABC sourcetype=XYZ subtype=### earliest=-90d@d latest=now  |timechart span=1d count as Incoming, count(eval(action="blocked")) as Blocked | eval date=strftime(_time, "%m/%d/%Y") |collect index=summary_index source="***"

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Change the Original Search like this

index=ABC sourcetype=XYZ subtype=### earliest=-90d@d latest=now  |timechart span=1d count as Incoming, count(eval(action="blocked")) as Blocked | eval date=strftime(_time, "%m/%d/%Y") |collect index=summary_index source="***"

abhijit_mhatre
Path Finder

Thanks @somesoni2

The query worked & now we are getting correct timestamp for events.

0 Karma

jkat54
SplunkTrust
SplunkTrust

They should also have a field called date yes?

If you want the full timestamp add _time to you stats command by clause:

... by date _time

0 Karma

adonio
Ultra Champion

like jkat54 said, ... | stats strips the time from results. add "by _time" to have that field

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...