Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Use of _indextime field in table or stats command

$
0
0
Hi All How can I use _indextime field in table or stats command without renaming or converting it. Not working Ex: * | table host source sourcetype _time _indextime _raw Its working if I rename the _indextime or convert the _indextime, But I want the results with _indextime as field Working Ex: * | eval indextime=_indextime | table host source sourcetype _time indextime _raw Thank you

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>