when my ETL is using select ...from, I can select the timestamp column according to my output table column. But if I am outputting a temp table (eg. #temp ) then the SPLUNK timestamp column has nothing to select. any idea?