Knowledge Management

How do I override _time in a saved search that saves to a summary index, such that the time the values goes in at is recognized when searching through the summary index?

briancronrath
Contributor

I am using a saved search that pulls in data from an external source with it's own time format. I've converted the format to match what I see when I output _time, and eval'd _time to be that converted value, but it doesn't seem to be getting recognized, because whenever the data comes in and I search on it, all the data just gets put to the beginning of today. Is there an extra step I'm missing in order to get _time to be overridden with my own values?

0 Karma

somesoni2
Revered Legend

You need to convert your custom date string to epoch and assign to field _time in the events. We may be more helpful if you could provide your current search, some sample values etc.

briancronrath
Contributor

Ahh that was my issue, I was using strftime after strptime to format it how I see _time when I output it through the UI, but I should have just been keeping it in epoch format. Thank you somesoni2 !

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.