Using a different value for _time

[williamsmew]

index=av sourcetype=BobsCutRateAV category="BadStuffHappening"
| eval date_hour=strftime(_time, "%H")
| eval date_wday = strftime(_time, "%w")
| search (date_hour>18 OR date_hour<6) OR (date_wday=0 OR date_wday=6)
| timechart count

This works. The problem is that _time reflects when the event is reported not when it was detected. The field I need is detected_timestamp which is formatted as detected_timestamp="2019-04-11 02:31:52.0"

I did not create this but have been tasked with modifying it. I have looked at documentation and the many things I have tried do not work. Your help is appreciated.

[martin_mueller · Accepted solution]

Assuming you always want to use detected_timetamp and never what is now _time, I'd recommend changing the timestamp extraction for that sourcetype. See https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Configuretimestamprecognition for how, and open new questions with any issues you might have.

If you want to do this in some search without changing the data getting indexed because most of the time what is now _time is the right time and only this time you want detected_timestamp, you can do something like this:

... | eval _time = strptime(detected_timestamp, "%F %T.%N") | eval date_hour = ...

XOR

... | eval date_hour ... | eval date_wday = ... | search ... | eval _time = strptime(detected_timestamp, "%F %T.%N") | timechart count

depending on whether the date_hour/date_wday filters you have right now should be applied to _time or detected_timestamp.

[martin_mueller]

Does this work in an empty search bar?

| makeresults | eval detected_timestamp="2019-04-11 02:31:52.5" | eval _time = strptime(detected_timestamp, "%Y-%m-%d %H:%M:%S.%N")

[williamsmew]

Yes it does

[martin_mueller]

%F is short for %Y-%m-%d, %T is short for %H:%M:%S - see http://www.strftime.net/ for an easy to use reference.

[williamsmew]

Yup, finally found that under Date and time variables. What perplexes me is why eval _time = strptime(detected_timestamp, "%Y-%m-%d %H:%M:%S.%N") does not work since it seems to be the the same as the F T N

[williamsmew]

Thanks for the response

Im confused where the "%F %T.%N" is from and how %H and %w is extracted, from what I can find I was using "%Y-%m-%d %H:%M:%S.%1n"

I dont have much in the way of resources to pull from here, these forums will be about it, so thank you.

[williamsmew]

And yes this is for a search being piped into a dashboard