All Apps and Add-ons

time setting for azure:eventhub using TA-MS-AAD

rayar
Contributor

How _time will be set for azure:eventhub using TA-MS-AAD  by default  ?

I don't see any configuration for _time but the indextime and the _time are not identical  

 

[azure:eventhub]
SHOULD_LINEMERGE = 0
category = Splunk App Add-on Builder
pulldown_type = 1
####################
# Metrics
####################

 

Few results for reference 

_time indextime count

2021-10-14 13:00:01.4312021-10-14 13:10:271
2021-10-14 13:00:01.4312021-10-14 13:10:351
2021-10-14 13:00:01.4312021-10-14 13:10:371
2021-10-14 13:00:01.4312021-10-14 13:10:43
Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...