How to extract timestamps for each event when importing data into the summary index in Splunk Enterprise 9.0.1.

[restinlinux]

Hey Splunkers !!

I'm Explore around summary index...

Wanted to know how to extract timestamps for each event when importing data into the summary index in Splunk Enterprise 9.0.1.....

check on the documentation.. couldn't able to find any inputs...

And if _time value of the event being summarized ... will the the _time value of the event be extracted even the _time is not included in search results....

[richgalloway]

See the add_time option to the collect command (https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Collect#Syntax) for when and how time is added to a summary index..