Why am I losing the timestamp for events after creating a summary index of results with the collect command?

[nivedita_viswan]

I'm using the collect command to copy a set of frequently queried events to a summary index. When I search for the following:

index= original_index | table _raw

I see a timestamp prefixing the log information.
I run the following query to populate my summary index:

index= original_index field=value | table field1, field2, field3 | collect index=summary_index

I use the table command to preserve the extracted fields in the summary index.

However, when i run the above query, I lose the actual timestamp of the event. Instead, all events in the summary index have the current system time as the timestamp.
I know this happens when the _raw field does not have time information, but that is not the case here.

How do i preserve the timestamp of the event in the summary index?

[ppablo · Accepted solution]

Hi @nivedita_viswanath

I was reading the documentation on the table command and it says...

"The table command can be used to build a scatter plot to show trends in the relationships between discrete values of your data. Otherwise, you should not use it for charts (such as chart or timechart) because the UI requires the internal fields (which are the fields beginning with an underscore, _*) to render the charts, and the table command strips these fields out of the results by default. Instead, you should use the fields command because it always retains all the internal fields."
http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Table

So the table command strips out the internal fields. Have you tried using the fields command?

[nivedita_viswan]

I really should have checked that about the table command.
Thanks, let me try using fields command and I'll confirm if this works.

[ppablo]

No problem. If it doesn't work, hopefully some other folks will come by and provide some other options.

[nivedita_viswan]

It did work! Thanks again.

[ppablo]

Awesome 🙂 you're welcome!