Getting Data In

Why is the "collect" command in my saved search saving generated data to an index with incorrect timestamps?

Explorer

Hi ,

I have a saved search that is executed every minute and generates data. I have a "collect index=" command in the search to save the generated data to an index.

My observation is that the index is collecting data, but with the incorrect value for the _time field of the index.

What is causing the invalid timestamp being recorded in _time field? How can I fix this?

Please let me know.

Thank you.

Explorer

Setting _time=now() and collecting the events in the index is setting the _time correctly to the current time.

But not sure if this is how collect should be working.

0 Karma

Explorer

Hi,
Some more information on the issue we are facing.

Seems like the _time is being set to latestTime of the search.

This is not right.

Please help.

Thank you.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!