Splunk Search

Why were some events removed by Timeliner when they were missing _time?

bsanjeeva
Explorer

Hi,

When I run a search against an index in smart/verbose mode, I am getting the below error with zero results,

"Some events were removed by Timeliner because they were missing _time"

However, when the same query is run in fast mode I am seeing results. Is there anything wrong with the time of the logs coming in? How should I fix this?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...