Splunk Search

Summary Index from | collect ... addtime=f : When searched _time is not equal to time from _raw and date_* fields

isaiz
Loves-to-Learn Lots

I created a summary index with a custom _raw from a tstats search from 03/14/2023 16:30:00 to 03/14/2023 16:35:00:

| tstats summariesonly=false count sum(common.sentbyte) AS sentbyte sum(common.rcvdbyte) AS rcvdbyte
FROM datamodel=CTTI_Fortinet_Log
WHERE common.subtype=forward
BY common.devname common.dstip common.sessionid

| rename common.devname as devname common.dstip as dstip common.sessionid as sessionid
| addinfo
| eval _time = strftime(info_min_time,"%m/%d/%Y %H:%M:%S %z")
| eval version=0.44
| eval _raw=_time . ", " .
                        "devname=". devname . ", " .
                         "dstip=" . dstip . ", " .
                         "sessionid=" . sessionid . ", " .
                         "sentbyte=" . coalesce(sentbyte,0) . ", " .
                         "rcvdbyte=" . coalesce(rcvdbyte,0) . ", " .
                         "version=" . version
| fields _raw
| collect index=superbasket_d_test addtime=f



It worked as intended, showing me the correct extracted _time and _raw in the collect query results but then when I search that same index for some reason it adds 1 second to _time.

timeplus1.PNG

 

Why does it happen?

Labels (5)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...