Splunk Search

Datamodel is giving results outside of the constraints given in Summary Range

jshah24
Explorer

I have accelerated my data model for 7 days period and Rebuild the datamodel.
After its completion, I have executed below query to get the acceleration period which is mentioned in https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Acceleratedatamodels document under "Using the summariesonly argument" section.

| tstats summariesonly=t min(_time) as min, max(_time) as max from datamodel=mydm | eval prettymin=strftime(min, "%c") | eval prettymax=strftime(max, "%c")

As per my understanding, prettymin should be 7 days older from the current date but it is showing the timestamp which corresponds to the index time of the very first event (which in my case is approx a month ago.)

Please, help me understand this behavior and let me know if any changes are required to show results in the specified summary range?

Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...