Need solution with custom time field

[vijaynela]

I am working Service now logs in Splunk. The tickets data has one field called "sys_created" this field gives the ticket created time in "%Y-%m-%d %H:%M:%S" format.

when I am running the query for the last 7 days. The tickets which were raised before 7 days are also populating because of another field called sys_updated.

This sys_updated field will store all the updates in the tickets, so if an old ticket is updated within last 7 days, it will be populated when i keep timerange picker as last 7 days.

Is there a way to consider "sys_created"  as "_time" ?

[ITWhisperer]

_time is set for the event when it is ingested. If you change the way the event is ingested, then perhaps you could use a different part of the event for the timestamp. However, this would only apply going forward, it would not re-index the existing events.

One possibility is that you could copy (using the collect command) the events to another index having reset the _time field to the value you want.