When I create report and enable summary index, the results are getting in the below format.
1 2022-06-01 12:01:30.802
1 2022-06-01 12:11:47.069
But when I call this summary index using spl query,
milliseconds are missing in _time column.
Query I have used,
|eventstats max(search_now) as latestsearch by id, report
|where search_now = latestsearch
This query is to fetch latest run result
It seems like this has been a problem for some time, e.g.
I generally avoid using the summary indexing option in the scheduled search, but instead use the collect statement directly in the SPL and format the _raw field I want, as _time is also a bit strange with the collect command.
You need to have a _raw with the _time value set in there, to make it work well, e.g.
``` Your search ... ``` | fields _time field1 field2... | eval _raw="_time="._time | foreach "*" [| eval _raw=_raw.case(isnull('<<FIELD>>'),"", true(), ", <<FIELD>>=\"".'<<FIELD>>'."\"") | fields - "<<FIELD>>" ] | collect index=your_summary_index addtime=f
Hi @ITWhisperer ,
This is the search I have used.
| eval id=mvindex(split(source,"/"),5)
| table id _raw
| rex field=_raw "(?<timestamp>[^|]+)\|(?<PID>[^|]+)"
| table id timestamp PID
| eval _time=strptime(timestamp,"%Y-%m-%d %H:%M:%S.%4N")
| table id _time PID
| sort 0 id _time
| streamstats count as s_no by id
| table id _time s_no PID