I have noticed that when summarizing some events that do not have a timestamp (tabular reports, data from lookups), the _time value is not set as I would expect. How does summary indexing decide what time to use?
To set the time for summary index events, Splunk uses the following information, in this order of precedence:
To set the time for summary index events, Splunk uses the following information, in this order of precedence:
But when I try simple below query its taking the current system time instead of _time of event.
index=indexname | collect index=si
I want the events in the summary index to retain the _time as it is in the primary index. But it's storing the current system time.
@araitz , please check n help...
I'm having the same issue. My events have a _time value, but it is not maintained in the summary index. It also stores the current system time which seems to contradict the precedence outlined above. Did you ever find a solution @AnilPujar?