Why is the _time value changing in the summary index?

Wendy1990 — Fri, 26 Jun 2015 14:40:40 GMT

I try to use summary indexing to improve search efficiency, but it's resulting in an error because of the wrong _time value.
Event timestamp 6/9/15 10:59:54.960 PM is reset to 6/9/15 12:00:00.000 AM in the summary index.

My original search string is:

sourcetype="ims*" host="chi*" FirmName!="Eze" FirmName!="(null)" | timechart useother=f count by FirmName

My saved search name is "firmtimechart"
Start time is "-6mon@s"
Finish time is "now"
Saved search string is:

sourcetype="ims*" host="chi*" FirmName!="Eze" FirmName!="(null)" | sitimechart useother=f count by FirmName

My search string is:

index=summary search_name="firmtimechart" | timechart limit=5 useother=f count by FirmName

I wonder why the timestamp is changing and how to solve it.

Re: Why is the _time value changing in the summary index?

pacrip — Tue, 13 Feb 2018 15:35:06 GMT

I think this is an issue with the way the timechart command is transforming the data. As you are looking over a large time range (6 months) the events are being bucketed into 1 day chunks so that they can be displayed nicely. You can test this by looking at the statistics tab after running the search using non-si commands and looking at the _time field in the returned events

If this isnt the desired behavior you could look at using a stats command instead to avoid any of the timestamp changes associated with timechart but at the end of the day the whole point of summary indexing is to summarise the data over a period so it makes sense to keep it bucketed as it is.

topic Re: Why is the _time value changing in the summary index? in Getting Data In

Why is the _time value changing in the summary index?

Re: Why is the _time value changing in the summary index?