After looking at the "Data Model Audit" dashboard in Splunk ES, in the "Acceleration Details" panel, we saw that some of the datamodels had their "earliest" time sat to "01/01/1970 01:00:00". We found out that this is from the command "| rest /services/admin/summarization by_tstats=t splunk_server=local count=0", which sets the field "summary.earliest_time" for some of our datamodels to "0".
If we run a tstats search on the datamodels for "all time", there are no events with this timestamp, not even close. As far as I can tell, the parsing works just fine, and no events in the datamodels are older than 3 months.
Why is the REST API still saying that the earliest time is epoch 0?
