Why does the time picker not work properly with customized formatted _time?

[xinde]

Hi,

In my query, the time stamp is created from the event content.

| rex "(?\d+\/\d+\/\d+\/\d+\/\d+\/\d+) (?\d*\.\d+|[[int]]) (?\d*\.\d+|[[int]])"
| eval _time=strptime(Time,"%Y/%m/%d/%H/%M/%S")  
| chart somevalues by _time 

Graph works well. but when I try to use Splunk time picker, last x hours does not return last x hours events.
it returns events from days ago.
Anyone knows what happened here? Thanks in advance!

EG:

event content: 2018/1/30/12/0/30 0.1 2.1
 _time: 2018-01-30T12:00:30.000-05:00

[raviopensource]

same problem here. Once the _time is customized the time picker results do not work.

[niketn]

@xinde, the regular expression that you are using in SPL to extract Time and override _time field should be applied to your data's sourcetype using props.conf so that events get correct timestamp. If you do not provide this, Splunk will pick from one of its default logic to identify timestamp (_time), which is what will be used by the Time Picker control.

If time extracted in SPL is correct and does not match with original _time field on the events then you have an issue with your data ingestion and you should fix event timestamp identification first. Also the data that you have already indexed will have wrong timestamp which means existing data needs to be re-indexed if you need them.

Documentation for reference:
http://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps
http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition

[niketn]

@xinde, I have converted to answer. Please accept if it addressed your query!