Splunk Search

Summary Index from | collect ... addtime=f : When searched _time is not equal to time from _raw and date_* fields

isaiz
Loves-to-Learn Lots

I created a summary index with a custom _raw from a tstats search from 03/14/2023 16:30:00 to 03/14/2023 16:35:00:

| tstats summariesonly=false count sum(common.sentbyte) AS sentbyte sum(common.rcvdbyte) AS rcvdbyte
FROM datamodel=CTTI_Fortinet_Log
WHERE common.subtype=forward
BY common.devname common.dstip common.sessionid

| rename common.devname as devname common.dstip as dstip common.sessionid as sessionid
| addinfo
| eval _time = strftime(info_min_time,"%m/%d/%Y %H:%M:%S %z")
| eval version=0.44
| eval _raw=_time . ", " .
                        "devname=". devname . ", " .
                         "dstip=" . dstip . ", " .
                         "sessionid=" . sessionid . ", " .
                         "sentbyte=" . coalesce(sentbyte,0) . ", " .
                         "rcvdbyte=" . coalesce(rcvdbyte,0) . ", " .
                         "version=" . version
| fields _raw
| collect index=superbasket_d_test addtime=f



It worked as intended, showing me the correct extracted _time and _raw in the collect query results but then when I search that same index for some reason it adds 1 second to _time.

timeplus1.PNG

 

Why does it happen?

Labels (5)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...