I am trying to collect the historical data from Snow to an existing indexer using the below query
| rename dvnumber as dvparent dvassignmentgroup as mainassigngroup shortdecription as desc
| join type=left number
[ search sourcetype="snow:sctask"
| stats latest(dvassignmentgroup) as sctaskassign by dvparent
| rename dvparent as number]
| sistats latest(time) as time, latest(sourcetype) as sourcetype, latest(dvclosedby) as dvclosedby, latest(shortdescription) as shortdescription,latest by source,number |addinfo|collect index=testsnow marker="searchname=snowreport"
The data is getting ingested in the new indexer but when i search the for events in test_snow indexer it is taking _time as the indexed time.I want the events to retain the original timestamp .I have tried adding eval _time="Time Field name" but that did not work.
According to docs, If you use the collect command with a time range of All time and the events do not have timestamps, the current system time is used for the timestamps.
One thing we need to be clear off here is the raw timestamp with the event is different than the index time of event. So, I'd take here that you are wanting to keep the original raw data time (i.e. event time) to be retained in your summary index and not the index time of your event.
you can add addtime=false as a option with collect command and Splunk will automatically extract time from _raw and no need to extract separately. This following post is more comprehensive explanation -
Hope this helps.
Please accept as answer if this would resolve your case. Thanks
looks like adding addtime=false is removing the _time from _raw
infomintime=1551369600.000, infomaxtime=1552233600.000, infosearchtime=1560742982.899, infosid="1560742982.6225", psrsvdv=1, psrsvdgc=9, psrsvdctactivitydue=9, psrsvdctdvclosedat=9, psrsvdctdvopenedat=9, psrsvdctdvopened_by=9,
If i try without addtime=false , raw looks like below.Here it is taking infomin_time as _time and not indexing time
03/01/2019 00:00:00 +0800, infomintime=1551369600.000, infomaxtime=1552233600.000, infosearchtime=1560743284.485, infosid="1560743284.6459", psrsvdv=1, psrsvdgc=9, psrsvdctactivity_due=9,
I was making it more complicated by adding sistats and addinfo.
I was able able to ingest the data in summary indexing by simply using the collect command without sistats and addinfo