I can’t make my time range picker pick my time field.

When you are working with Hadoop using Hunk or when you are working with Splunk and the time field you want to work with is not _time, you may want to use the time picker in a dashboard with some other time field. You may have the same problem when the current _time field is not the time field you want to use for the current search.

Here is a solution you might use to make time selections work in every case including in panels.

| inputlookup SampleData.csv
| eval _time=strptime(claim_filing_date,"%Y-%m-%d")
| sort - _time
| addinfo
| where _time>=info_min_time AND (_time<=info_max_time OR info_max_time="+Infinity")

Let’s Break this search down into its parts.

| inputlookup SampleData.csv

This is an example of …

» Continue reading

sourcetypes – What’s in name?

When setting up data inputs for Splunk, it is never long before you start to talk about the semantics of names for Sourcetypes. So how do I name my sourcetype and what difference does that make?
» Continue reading