Getting Data In

Why is the _time value changing in the summary index?

Wendy1990
New Member

I try to use summary indexing to improve search efficiency, but it's resulting in an error because of the wrong _time value.
Event timestamp 6/9/15 10:59:54.960 PM is reset to 6/9/15 12:00:00.000 AM in the summary index.

My original search string is:

sourcetype="ims*" host="chi*" FirmName!="Eze" FirmName!="(null)" | timechart useother=f count by FirmName

My saved search name is "firmtimechart"
Start time is "-6mon@s"
Finish time is "now"
Saved search string is:

sourcetype="ims*" host="chi*" FirmName!="Eze" FirmName!="(null)" | sitimechart useother=f count by FirmName

My search string is:

index=summary search_name="firmtimechart" | timechart limit=5 useother=f count by FirmName

I wonder why the timestamp is changing and how to solve it.

0 Karma

pacrip
Path Finder

I think this is an issue with the way the timechart command is transforming the data. As you are looking over a large time range (6 months) the events are being bucketed into 1 day chunks so that they can be displayed nicely. You can test this by looking at the statistics tab after running the search using non-si commands and looking at the _time field in the returned events

If this isnt the desired behavior you could look at using a stats command instead to avoid any of the timestamp changes associated with timechart but at the end of the day the whole point of summary indexing is to summarise the data over a period so it makes sense to keep it bucketed as it is.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...