Splunk Search

can't use a field with special characters in search --> _@timestamp

pavan_injarapu
Explorer

I have a field named '_@timestamp' in my data. When i search for this field, the result doesn't show up. May be because this is being treated as an internal field by Splunk. How to query for this field?

index::<> | fields _@timestamp time

Fields section resulted from 'search' only has time field but not _@timestamp

0 Karma

to4kawa
Ultra Champion
|makeresults
| eval "_@timestamp"=now()
| eval time='_@timestamp'
| rename "_@timestamp" as visible_time

hi @pavan_injarapu
That's a great field name.

0 Karma

adonio
Ultra Champion

try something like this:
index::<yourindexhere> | fields _@timestamp time | eval time2 = _@timestamp

0 Karma

pavan_injarapu
Explorer

Thanks for the response Adonio, its not working

0 Karma

adonio
Ultra Champion

switch it then:
index:: | eval time2 = _@timestamp| fields time2 time

0 Karma

pavan_injarapu
Explorer

I tried all such combinations already 🙂

0 Karma

Vijeta
Influencer

May be the field is not parsed or extracted , its part of raw event only. In order to use it you need to create a field extraction. Can you share some sample log please.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...