topic Overwriting _time in datamodel causing mismatch between _time and time picker in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Overwriting-time-in-datamodel-causing-mismatch-between-time-and/m-p/410596#M72736 <P>Hello,</P> <P>I am overwriting _time in datamodel because there is no proper timestamp in logs. when I am trying to access data using tstat search, _time is not sync with time picker.</P> <P>In below screen shot I have attached 2 search <BR /> 1) when I select All time, data is there with updated time as per defined in datamodel.<BR /> 2) when I narrow down in time picker I can't see any data.<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6165i24248EE33A663196/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Overwrite _time in datamodel<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6166iD765E45A717F1413/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Sun, 25 Nov 2018 18:02:56 GMT AKG1_old1 2018-11-25T18:02:56Z Overwriting _time in datamodel causing mismatch between _time and time picker https://community.splunk.com/t5/Getting-Data-In/Overwriting-time-in-datamodel-causing-mismatch-between-time-and/m-p/410596#M72736 <P>Hello,</P> <P>I am overwriting _time in datamodel because there is no proper timestamp in logs. when I am trying to access data using tstat search, _time is not sync with time picker.</P> <P>In below screen shot I have attached 2 search <BR /> 1) when I select All time, data is there with updated time as per defined in datamodel.<BR /> 2) when I narrow down in time picker I can't see any data.<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6165i24248EE33A663196/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Overwrite _time in datamodel<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6166iD765E45A717F1413/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Sun, 25 Nov 2018 18:02:56 GMT https://community.splunk.com/t5/Getting-Data-In/Overwriting-time-in-datamodel-causing-mismatch-between-time-and/m-p/410596#M72736 AKG1_old1 2018-11-25T18:02:56Z