Scenerio:
1.Created summary index and scheduled to run every 5 minutes
2.We can see that summary index is writing data to new index
3.But the time stamp of event was wrong. So we wanted to extract the time stamp from our event.
As per documentation:
Scheduled report with summary indexing by default Splunk assigns the source field to the name of the generating report and sourcetype field to "stash" which is how Splunk know that data is already in Splunk and the summary data will not be charged against the license
In our use case report for summary indexing name was "test_report"
[source::test_report]
MAX_TIMESTAMP_LOOKAHEAD=19
TIME_PREFIX= CreateDate=\"
TIME_FORMAT = %Y-%m-%d %H:%M:%S
Restarted Splunk splunk on indexer but still time stamp of summary indexed data was showing incorrect
Updated props.conf on indexer as below
[sourcetype::stash]
MAX_TIMESTAMP_LOOKAHEAD=19
TIME_PREFIX= CreateDate=\"
TIME_FORMAT = %Y-%m-%d %H:%M:%S
Restarted Splunk splunk on indexer but still time stamp of summary indexed data was showing incorrect
1.On a Search Head:
Settings > Searches, reports, and alerts -> Open test_report : alert
append your search with below (add to the end of your search string)
| eval _time=strptime(CreateDate,"%Y-%m-%d %H:%M:%S")
For summary indexing report if you ever had to extract time please add _time as part of your search. Updating props.conf on indexer will not work as per my experience.