Ch. 5 Working with Time
Time in Splunk - When an event data is ingested into Splunk, time stamp is recorded in the _time field of the event
Most efficient filter - filtering by time, because every event in Splunk is ordered by time ingested
Splunk Timeline - bar chart of search results based on the time they occurred (i.e. what time is stored in the _time field of the event)
Time Modifiers - add these to your search query to add specific time ranges, like 5 minute time range, a few days, or months. Basically if the Time Picker does not have the time range you actually need to solve your problem
Ex. pull data from 2 weeks ago till today: earliest=-14d@d latest=@d
Time Setting - If you see a different time in time column of search results vs. the event data, that means a time zone is being applied to the time column
If an event does not have a time stamp, then Splunk will apply the timestamp of when the event data was indexed for the time column
bin command and _time field - use the bin to group event data, and use span to specify time
ex. group events within the same hour: bin _time span=1h
Correct ways to use bin _time
| bin _time span=1m
| bin _time span=1mins
Understand the stats command and how its function alter the results of using the command
timechart command - plots and trends data over time, with _time field as the x axis
by clause - like the word per
Ex. timechart count by vendor_action TimePicker = Last 24 hours - so this search query is counting all the events of the last 24 hours and grouping them every 30min for the value inside the vendor_action field of the event and grouping the events that do not contain the vendor_action field as null.
timewrap command - used to display multiple weeks
Convert the hour into your local timezone that you set in Splunk settings: eval my_hour = strftime(_time, “%H”)
date_time will alwats reflect raw event time
Why is this false? Using earliest=-30d@d latest=@d is how to return results from 30 days ago up until the time the search was executed.