How to capture the time when the notable alert was fired, in a field?

[Vnam]

I have to populate a field called event_generation_time. I want to populate the time when notable event was created for a correlation search in this field, is there any way to capture this timestamp?

[woodcock]

Just add this to the end of your SPL:

| eval now=now(), time=time()

The difference is that now is when the report was supposed to run, but time is when it actually ran (there are features to delay start times to skew the demand).
To keep them "invisible", do this:

| eval _now=now(), _nowtime=time()

[Vnam]

Is there a way to do this without changing SPL, because it was not configured before and would require a change in all the correlation searches? Is there some metadata field which can be used, for instance I saw there was a field "info_max_time" in Notable event stash, will this be the correct field to use for this purpose? (Ref: http://dev.splunk.com/view/enterprise-security/SP-CAAAFBA).
Thanks in Advance!

[woodcock]

Nothing that I know.