how to display time of event as a table column

Question

I have the following query:

host=wps03 mc_getLDAPGroupsTimer | table time host username mc_getLDAPGroupsTimer | sort -mc_getLDAPGroupsTimer

I am trying to get the date and time to display in the table, so I can see what happened when, but I obviously have the syntax incorrect. Or, maybe this is not possible for some logical reason.

How can I display the date and time of an event in a table?

Thanks, Sean

Accepted Answer

2	You have the right idea, but you appear to be missing the underscore at the beginning of the `_time` field. link answered 07 Apr '11, 14:03 southeringtonp ♦ 4.5k●1●2●15 accept rate: 35% 1 Awesome, worked like a charm! (07 Apr '11, 14:11) seanlon11

how to display time of event as a table column

Follow this question

Splunk Resources

Related questions