Hey there, Results of the | fit command are affected by the time range picker. Once you set the time range to all time, _time is displayed normally. Edit: I looked into the interaction between ...
See more...
Hey there, Results of the | fit command are affected by the time range picker. Once you set the time range to all time, _time is displayed normally. Edit: I looked into the interaction between inputlookup + fit + time range picker. As documented here, the result of the fit command are appended to the initial dataset. In this case, the expected outcome would be that the resulting table includes only rows that are covered by the time range picker. However, the following happens: Time range picker: All time Resulting table: Initial dataset + output of fit command Result: OK, expected result Time range picker: Some time before the first observation - now Resulting table: Initial dataset + output of fit command Result: OK, expected result (Warning: The specified span would result in too many (>50000) rows.) Time range picker: About halfway through the dataset timestamps - now Resulting table: Initial dataset + output of fit command Result: OK, unexpected result (Warning: The specified span would result in too many (>50000) rows.) Time range picker: After some time of the last observation - now Resulting table: Initial dataset + output of fit command Result: OK, unexpected result (Warning: The specified span would result in too many (>50000) rows.) Time range picker: Some time before the first observation - some time stamp after the last observation Resulting table: output of fit command Result: NOT OK, unexpected result I checked the sources that were available to me (search.log, .py files) but sadly this did not suffice to reverse engineer how the initial dataset and the output of the fit command are merged and filtered. It seems that earliest has no effect, but once latest is set to a timestamp, the behavior becomes unexpected.