Splunk Search
Highlighted

Datamodel is giving results outside of the constraints given in Summary Range

Explorer

I have accelerated my data model for 7 days period and Rebuild the datamodel.
After its completion, I have executed below query to get the acceleration period which is mentioned in https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Acceleratedatamodels document under "Using the summariesonly argument" section.

| tstats summariesonly=t min(_time) as min, max(_time) as max from datamodel=mydm | eval prettymin=strftime(min, "%c") | eval prettymax=strftime(max, "%c")

As per my understanding, prettymin should be 7 days older from the current date but it is showing the timestamp which corresponds to the index time of the very first event (which in my case is approx a month ago.)

Please, help me understand this behavior and let me know if any changes are required to show results in the specified summary range?