When searching against a datamodel, a common search syntax is
| tstats min(_time) as earliest from datamodel=.....
Is the "_time" in datamodel the same as the "_time" in index, or it's the time when properties get populated into the datamodel?
Both are same. Datamodel does not alter the _time of the event.