Splunk Enterprise

Splunk Summary Index : How to include actual time in summary index

beriwalnishant
Path Finder

Hi Team,

I was comparing the Summary Index transaction time with the live Splunk server transaction time. I see all transactions collected in 15min bucket keep the same time and override the actual transaction time.

Is there a way to retain the original time while still keeping the count going in buckets define?

 

Nishant

Labels (3)
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...