From _raw events I do not see _indextime

[lpolo]

I am wondering why from some set of _raw indexes I do not see _indextime. I should see it. Any idea?

Thanks,
Lp

[gcusello]

Hi @lpolo,
_indextime isn't a field displayed by default (I don't know why!), but it's always present, if you want it you must explicitate it using table or eval to display in human readable format:

index=my_index
| eval indextime=strftime(_indextime,"%d/%m/%Y %H:%M:%S")
| table _time indextime _raw

Ciao.
Giuseppe

[lpolo]

Thanks!
I am aware that it should always be present that is the reason of my question. I am wondering why some indexes I can see it with this simple query:

index=myindex| table _time _indextime

But with some other indexes I need to do this to see it:
index=myindex | eval indextime=_indextime | table _time indextime _indextime

[lpolo]

Grazie Mille Giuseppe. Forza Italia. 🙂

[gcusello]

You're welcome".
if you're staisfied by this answer, please accept and/or upvote it, for the other memebers of the Community.

sempre!
Ciao.
Giuseppe