Yes, you are right. Once I have added | last(_time) as original_time in my search query, the time stamp is correct based on the time returned by last(_time). I probably overlooked it as I was dealing with current Bluecoat events, but they were obvious once I pumped in old logs and I could see the time being indexed correctly.
Thanks for your help!
... View more
I have a whole bunch of Bluecoat logs in which I will need to create Summary Indexes for them due to the log volume. Some of the common searches would be things like Top Blocked URLs, or Top 10 IP Addresses.
So I have the backfill script running, and I noticed that the _time is actually set to the time when the backfill script has ran. So as a result, I couldn't do a report generation on June 2009 for example.
Following the information from the earlier thread at http://answers.splunk.com/questions/3223/summary-index-event-date-and-sourcetype, I have now added a "| last(_time) as original_time" to one of the fields in my summary Index.
Everything looks good, and I have the original_time as one of the field, but the question is - is there any easier way for me to generate a report by making original_time as _time so that I can use the TimeRangePicker for example?
If not, I will have to resort to using search commands like original_time > 1234567890 AND original_time < 133333333 for example to refine the time range to match June 2009 and so forth.
Thanks for any suggestions!
... View more