Knowledge Management
Highlighted

_time in datamodel is the same as the time in index?

New Member

When searching against a datamodel, a common search syntax is 

| tstats min(_time) as earliest from datamodel=.....

 

Is the "_time" in datamodel the same as the "_time" in index, or it's the time when properties get populated into the datamodel? 

 

 

Labels (1)
0 Karma
Highlighted

Re: _time in datamodel is the same as the time in index?

Communicator

@stonelzhangh 

Both are same. Datamodel does not alter the _time of the event. 

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.