Getting Data In
Highlighted

Why am I losing the timestamp for events after creating a summary index of results with the collect command?

Path Finder

I'm using the collect command to copy a set of frequently queried events to a summary index. When I search for the following:

index= original_index | table _raw

I see a timestamp prefixing the log information.
I run the following query to populate my summary index:

index= original_index field=value | table field1, field2, field3 | collect index=summary_index

I use the table command to preserve the extracted fields in the summary index.

However, when i run the above query, I lose the actual timestamp of the event. Instead, all events in the summary index have the current system time as the timestamp.
I know this happens when the _raw field does not have time information, but that is not the case here.

How do i preserve the timestamp of the event in the summary index?

0 Karma
Highlighted

Re: Why am I losing the timestamp for events after creating a summary index of results with the collect command?

Community Manager
Community Manager

Hi @nivedita_viswanath

I was reading the documentation on the table command and it says...

"The table command can be used to build a scatter plot to show trends in the relationships between discrete values of your data. Otherwise, you should not use it for charts (such as chart or timechart) because the UI requires the internal fields (which are the fields beginning with an underscore, _*) to render the charts, and the table command strips these fields out of the results by default. Instead, you should use the fields command because it always retains all the internal fields."
http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Table

So the table command strips out the internal fields. Have you tried using the fields command?

View solution in original post

Highlighted

Re: Why am I losing the timestamp for events after creating a summary index of results with the collect command?

Path Finder

I really should have checked that about the table command.
Thanks, let me try using fields command and I'll confirm if this works.

0 Karma
Highlighted

Re: Why am I losing the timestamp for events after creating a summary index of results with the collect command?

Community Manager
Community Manager

No problem. If it doesn't work, hopefully some other folks will come by and provide some other options.

0 Karma
Highlighted

Re: Why am I losing the timestamp for events after creating a summary index of results with the collect command?

Path Finder

It did work! Thanks again.

0 Karma
Highlighted

Re: Why am I losing the timestamp for events after creating a summary index of results with the collect command?

Community Manager
Community Manager

Awesome 🙂 you're welcome!

0 Karma