Is the search range for real-time search "_time" or "indextime"?

[skasagawa]

For example, a real-time search is being performed in the past 10 minutes window.

At this time, data with a timestamp of 15 minutes ago was imported.

When the search for _time, there are no hits because it does not correspond to the past 10 minutes, but when the search for indextime, there are hits.
I would like to know which is the basis of the search in real-time search.

[inventsekar · Accepted solution]

hi @skasagawa ... Pls run this search with real time.. 

index=yourindex
| eval indexTime = _indextime
| table _time, indexTime
| convert ctime(indexTime)

 the _indextime will be the timestamp at which the event was received at the indexer and the _time is the timestamp of the event.  (at times, the difference between _time and _indextime of few seconds can be accepted. if the difference is like 1 or 2 mins or more, then, you should do some troubleshooting of the host timestamp)

so most probably your events have some wrong time settings. pls let us know if you have questions.. thanks..