Hello,
I am overwriting _time in datamodel because there is no proper timestamp in logs. when I am trying to access data using tstat search, _time is not sync with time picker.
In below screen shot I have attached 2 search
1) when I select All time, data is there with updated time as per defined in datamodel.
2) when I narrow down in time picker I can't see any data.
Overwrite _time in datamodel
