I am using a scheduled report to save data to a summary index with the following query:
index=_internal | stats count by status | collect index=test_index addtime=true testmode=true marker="sch_rpt_name=Test_Report"
It outputs a _raw value like this :
01/12/2022 20:00:00 +0000, info_min_time=1642017600.000, info_max_time=1642106259.000, info_search_time=1642106259.959, count=63985, status=200, scheduled_report_test=Test_report
Is there a way to get rid of the info_search_time field?
The fields appear to be added by the summary index processor when the stash file is written to disk.
Is there a particular reason you do not want the data to appear in _raw?