topic How is how_time set when experiencing TA-MS-AAD data indexing delays? in All Apps and Add-ons

How is how_time set when experiencing TA-MS-AAD data indexing delays?

rayar — Thu, 19 Jan 2023 22:13:08 GMT

I have configuration for TA-MS-AAD and we see that we have delays

trying to understand how _time is set

Re: TA-MS-AAD data indexing delays- How is how_time set?

davidoff96 — Thu, 19 Jan 2023 21:27:24 GMT

If I understand this correctly, this is for this add-on: https://splunkbase.splunk.com/app/3757

Which sourcetype are you seeing _time issues with? Each sourcetype has a different method of getting _time (some use "createdDateTime", others use CURRENT).

Re: TA-MS-AAD data indexing delays- How is how_time set?

rayar — Sun, 22 Jan 2023 09:22:36 GMT

02:05:19	2023-01-22 08:13:19	2023-01-22 06:08:00.000	azure:eventhub
02:05:41	2023-01-22 08:08:41	2023-01-22 06:03:00.000	azure:eventhub
02:05:41	2023-01-22 08:08:41	2023-01-22 06:03:00.000	azure:eventhub
02:05:51	2023-01-22 08:08:51	2023-01-22 06:03:00.000	azure:eventhub
02:05:51	2023-01-22 08:08:51	2023-01-22 06:03:00.000	azure:eventhub
02:06:09	2023-01-22 08:09:09	2023-01-22 06:03:00.000	azure:eventhub
02:06:09	2023-01-22 08:09:09	2023-01-22 06:03:00.000	azure:eventhub
02:06:39	2023-01-22 08:20:39	2023-01-22 06:14:00.000	azure:eventhub
02:07:08	2023-01-22 08:13:08	2023-01-22 06:06:00.000	azure:eventhub