Timestamp extraction failing for data indexed via summary indexing

[sdubey_splunk]

Scenerio:
1.Created summary index and scheduled to run every 5 minutes
2.We can see that summary index is writing data to new index
3.But the time stamp of event was wrong. So we wanted to extract the time stamp from our event.

As per documentation:
Scheduled report with summary indexing by default Splunk assigns the source field to the name of the generating report and sourcetype field to "stash" which is how Splunk know that data is already in Splunk and the summary data will not be charged against the license

In our use case report for summary indexing name was "test_report"

1. To extract date we configured and updated props.conf on indexer to extract correct time from event. eg: Below props.conf I tested on sample event by manually uploading the data to splunk and I found it working as required.

[source::test_report]
MAX_TIMESTAMP_LOOKAHEAD=19
TIME_PREFIX= CreateDate=\"
TIME_FORMAT = %Y-%m-%d %H:%M:%S

Restarted Splunk splunk on indexer but still time stamp of summary indexed data was showing incorrect

1. We tried using sourcetype id stash to see if it works.

Updated props.conf on indexer as below

[sourcetype::stash]
MAX_TIMESTAMP_LOOKAHEAD=19
TIME_PREFIX= CreateDate=\"
TIME_FORMAT = %Y-%m-%d %H:%M:%S

Restarted Splunk splunk on indexer but still time stamp of summary indexed data was showing incorrect

[sdubey_splunk]

1.On a Search Head:
Settings > Searches, reports, and alerts -> Open test_report : alert
append your search with below (add to the end of your search string)

| eval _time=strptime(CreateDate,"%Y-%m-%d %H:%M:%S")

1. Wait for next schedule to run and it started working ie timestamp extraction worked.

For summary indexing report if you ever had to extract time please add _time as part of your search. Updating props.conf on indexer will not work as per my experience.