Getting Data In

Overwriting _time in datamodel causing mismatch between _time and time picker



I am overwriting _time in datamodel because there is no proper timestamp in logs. when I am trying to access data using tstat search, _time is not sync with time picker.

In below screen shot I have attached 2 search
1) when I select All time, data is there with updated time as per defined in datamodel.
2) when I narrow down in time picker I can't see any data.
alt text

Overwrite _time in datamodel
alt text

0 Karma