Splunk Summary Index : How to include actual time in summary index

beriwalnishant — Mon, 10 Jan 2022 10:52:18 GMT

Hi Team,

I was comparing the Summary Index transaction time with the live Splunk server transaction time. I see all transactions collected in 15min bucket keep the same time and override the actual transaction time.

Is there a way to retain the original time while still keeping the count going in buckets define?

Nishant

topic Splunk Summary Index : How to include actual time in summary index in Splunk Enterprise

Splunk Summary Index : How to include actual time in summary index