index=xyz | bin span=10m _time | stats count as Count by _time
where Count > 0
My alert is triggered and I receive an alert email. When I click on “View Results in Splunk” link in the email, I land on search results page, 'Statistics' tab. I notice that the time window displayed next to the search field is correctly set to "Last 10 minutes". Time window above the tabs (Events, Statistics, Visualization) is also correctly set last 10 minutes. (Eg: 4 events (10/19/16 2:10:00.000 PM to 10/19/16 2:20:00 PM)
However, when I click on a row displayed in tabular format in Statistics tab, and I see a popup with a different timestamp, with millisecond resolution. (2:10:00.000 to 2:10:00.001)
Clicking on "View Events" link in that pop-up leads to empty results page, because of the millisecond resolution.
Did anyone run into this before? If so, how did you fix it? We are using Splunk version 6.5.0.