How _time will be set for azure:eventhub using TA-MS-AAD by default ?
I don't see any configuration for _time but the indextime and the _time are not identical
[azure:eventhub]
SHOULD_LINEMERGE = 0
category = Splunk App Add-on Builder
pulldown_type = 1
####################
# Metrics
####################
Few results for reference
_time indextime count
2021-10-14 13:00:01.431 | 2021-10-14 13:10:27 | 1 |
2021-10-14 13:00:01.431 | 2021-10-14 13:10:35 | 1 |
2021-10-14 13:00:01.431 | 2021-10-14 13:10:37 | 1 |
2021-10-14 13:00:01.431 | 2021-10-14 13:10:43 |