Archive
Highlighted

Splunk.intersplunk: Receiving error "could not locate the time (_time) field..."

New Member

How come I can't locate the time (_time) field on some results returned from the external search command?

Hi,

I use Splunk.Intersplunk library to do my search command, but sometimes output receives the error:
"could not locate the time (_time) field on some results returned from the external search command".

Does anyone know why this is happening?

0 Karma
Highlighted

Re: Splunk.intersplunk: Receiving error "could not locate the time (_time) field..."

Motivator

Hello @santosm,

Recently I came across this issue and I found out that if you use your command as streaming command you need to return _time field. So you can get this field from results streamed to the command and returned with other fields.

0 Karma