Splunk Search

Summary Index from | collect ... addtime=f : When searched _time is not equal to time from _raw and date_* fields

isaiz
Loves-to-Learn Lots

I created a summary index with a custom _raw from a tstats search from 03/14/2023 16:30:00 to 03/14/2023 16:35:00:

| tstats summariesonly=false count sum(common.sentbyte) AS sentbyte sum(common.rcvdbyte) AS rcvdbyte
FROM datamodel=CTTI_Fortinet_Log
WHERE common.subtype=forward
BY common.devname common.dstip common.sessionid

| rename common.devname as devname common.dstip as dstip common.sessionid as sessionid
| addinfo
| eval _time = strftime(info_min_time,"%m/%d/%Y %H:%M:%S %z")
| eval version=0.44
| eval _raw=_time . ", " .
                        "devname=". devname . ", " .
                         "dstip=" . dstip . ", " .
                         "sessionid=" . sessionid . ", " .
                         "sentbyte=" . coalesce(sentbyte,0) . ", " .
                         "rcvdbyte=" . coalesce(rcvdbyte,0) . ", " .
                         "version=" . version
| fields _raw
| collect index=superbasket_d_test addtime=f



It worked as intended, showing me the correct extracted _time and _raw in the collect query results but then when I search that same index for some reason it adds 1 second to _time.

timeplus1.PNG

 

Why does it happen?

Labels (5)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...