Summary Indexing - Collect command is taking the system time

[sumeetsirohi1]

I am trying to collect the historical data from Snow to an existing indexer using the below query

sourcetype="snow:sc_task"
| rename dv_number as dv_parent dv_assignment_group as main_assign_group short_decription as desc
| join type=left number
[ search sourcetype="snow:sc_task"
| stats latest(dv_assignment_group) as sc_task_assign by dv_parent
| rename dv_parent as number]
| sistats latest(_time) as _time, latest(sourcetype) as sourcetype, latest(dv_closed_by) as dv_closed_by, latest(short_description) as short_description,latest by source,number |addinfo|collect index=test_snow marker="search_name=snow_report"

The data is getting ingested in the new indexer but when i search the for events in test_snow indexer it is taking _time as the indexed time.I want the events to retain the original timestamp .I have tried adding eval _time="Time Field name" but that did not work.

[amitm05]

@sumeetsirohi1

According to docs, If you use the collect command with a time range of All time and the events do not have timestamps, the current system time is used for the timestamps.
One thing we need to be clear off here is the raw timestamp with the event is different than the index time of event. So, I'd take here that you are wanting to keep the original raw data time (i.e. event time) to be retained in your summary index and not the index time of your event.

you can add addtime=false as a option with collect command and Splunk will automatically extract time from _raw and no need to extract separately. This following post is more comprehensive explanation -
https://answers.splunk.com/answers/690534/how-do-i-set-time-with-collect-raw.html

Hope this helps.
Please accept as answer if this would resolve your case. Thanks

[sumeetsirohi1]

looks like adding addtime=false is removing the _time from _raw

_raw
info_min_time=1551369600.000, info_max_time=1552233600.000, info_search_time=1560742982.899, info_sid="1560742982.6225", psrsvd_v=1, psrsvd_gc=9, psrsvd_ct_activity_due=9, psrsvd_ct_dv_closed_at=9, psrsvd_ct_dv_opened_at=9, psrsvd_ct_dv_opened_by=9,

If i try without addtime=false , _raw looks like below.Here it is taking info_min_time as _time and not indexing time

_raw
03/01/2019 00:00:00 +0800, info_min_time=1551369600.000, info_max_time=1552233600.000, info_search_time=1560743284.485, info_sid="1560743284.6459", psrsvd_v=1, psrsvd_gc=9, psrsvd_ct_activity_due=9,

[sumeetsirohi1]

I was making it more complicated by adding sistats and addinfo.
I was able able to ingest the data in summary indexing by simply using the collect command without sistats and addinfo