Event time is not showing correctly on Dashboard table

[mninansplunk]

Hello everyone,

I'm having an issue that I'm trying to understand and fix.  I have a Dashboard table that displays the last 24 hrs of events.  However, the event _time is always showing 11 min past the hour like:

Which these aren't the correct event times.  When I run the exact same search manually, I get the correct event times.

Does anyone know why this is occurring and how I can fix it?

Thanks for any help on this one, much appreciated.

Tom

[dural_yyz]

Your searches are different between DS and manual search.

```WRONG TIME STAMP - MINUTE```

index="netscaler" host=*
| rex field="servicegroupname" "\?(?<Name>[^\?]+)"
| rex field="servicegroupname" "(?<ServiceGroup>[^\?]+)"
| rename "state" AS LastStatus
| eval Component = host."|".servicegroupname
| search Name=*
| eval c_time=strftime(Time,"%m/%d/%y %H:%M:%S")
| streamstats window=1 current=f global=f values(LastStatus) as Status by Component
| where LastStatus!=Status
| eval Time = c_time
| table _time, host, ServiceGroup, Name, Status, LastStatus

```CORRECT TIME STAMPE```

index="netscaler" host=*
| rex field="servicegroupname" "\?(?<Name>[^\?]+)"
| rex field="servicegroupname" "(?<ServiceGroup>[^\?]+)"
| rename "state" AS LastStatus
| eval Component = host."|".servicegroupname
| search Name=*
| streamstats window=1 current=f global=f values(LastStatus) as Status by Component
| where LastStatus!=Status
| table _time, host, ServiceGroup, Name, Status, LastStatus

[isoutamo]

This should mater as _time didn't get value from c_time or Time. Basically those lines are not needed. Unless there is some weird alias in props.conf or something which put e.g. Time in _time field?

You should try to find where in this Dashboard is something which are manipulating _time based on c_time or Time field.

[dural_yyz]

Good call on the props, honestly a wild guess is that Month number is somehow inserted as Minute.  Running the dashboard for October would be a good litmus test for that.  But I didn't see anything in the original to make me think that was a real possibility.