Splunk Cloud Platform

Why Summary index not generating milliseconds when used in spl query?

Path Finder

When I create report and enable summary index, the results are getting in the below format.



id    _time

1      2022-06-01 12:01:30.802

1      2022-06-01 12:11:47.069


But when I call this summary index using spl query,

milliseconds are missing in _time column.


Query I have used,

index="summary" report="yy"

|eventstats max(search_now) as latestsearch by id, report

|where search_now = latestsearch


This query is to fetch latest run result

Labels (2)
Tags (3)
0 Karma


It seems like this has been a problem for some time, e.g.


I generally avoid using the summary indexing option in the scheduled search, but instead use the collect statement directly in the SPL and format the _raw field I want, as _time is also a bit strange with the collect command.

You need to have a _raw with the _time value set in there, to make it work well, e.g.

``` Your search ... ```
| fields _time field1 field2...
| eval _raw="_time="._time
| foreach "*" 
    [| eval _raw=_raw.case(isnull('<<FIELD>>'),"",
                           true(), ", <<FIELD>>=\"".'<<FIELD>>'."\"") 
    | fields - "<<FIELD>>" ] 

| collect index=your_summary_index addtime=f 


0 Karma


What search have you used to populate the summary index?

0 Karma

Path Finder

Hi @ITWhisperer ,
This is the search I have used.

index="xxx" source="*yyy"
| eval id=mvindex(split(source,"/"),5)
| reverse
| table id _raw
| rex field=_raw "(?<timestamp>[^|]+)\|(?<PID>[^|]+)"
| table id timestamp PID
| eval _time=strptime(timestamp,"%Y-%m-%d %H:%M:%S.%4N")
| table id _time PID
| sort 0 id _time
| streamstats count as s_no by id
| table id _time s_no PID

0 Karma


You can see from my earlier post that this appears to be an issue that is still unresolved, so you will need to address it another way, as referenced.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...