Knowledge Management
Highlighted

Summary Indexing - Collect command is taking the system time

New Member

I am trying to collect the historical data from Snow to an existing indexer using the below query

sourcetype="snow:sctask"
| rename dv
number as dvparent dvassignmentgroup as mainassigngroup shortdecription as desc
| join type=left number
[ search sourcetype="snow:sctask"
| stats latest(dv
assignmentgroup) as sctaskassign by dvparent
| rename dvparent as number]
| sistats latest(
time) as time, latest(sourcetype) as sourcetype, latest(dvclosedby) as dvclosedby, latest(shortdescription) as shortdescription,latest by source,number |addinfo|collect index=testsnow marker="searchname=snowreport"

The data is getting ingested in the new indexer but when i search the for events in test_snow indexer it is taking _time as the indexed time.I want the events to retain the original timestamp .I have tried adding eval _time="Time Field name" but that did not work.

0 Karma
Highlighted

Re: Summary Indexing - Collect command is taking the system time

Builder

@sumeetsirohi1

According to docs, If you use the collect command with a time range of All time and the events do not have timestamps, the current system time is used for the timestamps.
One thing we need to be clear off here is the raw timestamp with the event is different than the index time of event. So, I'd take here that you are wanting to keep the original raw data time (i.e. event time) to be retained in your summary index and not the index time of your event.

you can add addtime=false as a option with collect command and Splunk will automatically extract time from _raw and no need to extract separately. This following post is more comprehensive explanation -
https://answers.splunk.com/answers/690534/how-do-i-set-time-with-collect-raw.html

Hope this helps.
Please accept as answer if this would resolve your case. Thanks

0 Karma
Highlighted

Re: Summary Indexing - Collect command is taking the system time

New Member

looks like adding addtime=false is removing the _time from _raw

raw
info
mintime=1551369600.000, infomaxtime=1552233600.000, infosearchtime=1560742982.899, infosid="1560742982.6225", psrsvdv=1, psrsvdgc=9, psrsvdctactivitydue=9, psrsvdctdvclosedat=9, psrsvdctdvopenedat=9, psrsvdctdvopened_by=9,

If i try without addtime=false , raw looks like below.Here it is taking infomin_time as _time and not indexing time

raw
03/01/2019 00:00:00 +0800, info
mintime=1551369600.000, infomaxtime=1552233600.000, infosearchtime=1560743284.485, infosid="1560743284.6459", psrsvdv=1, psrsvdgc=9, psrsvdctactivity_due=9,

0 Karma
Highlighted

Re: Summary Indexing - Collect command is taking the system time

New Member

I was making it more complicated by adding sistats and addinfo.
I was able able to ingest the data in summary indexing by simply using the collect command without sistats and addinfo

0 Karma