Hello,
Why does changing addtime=false on scheduled summary index - advanced edit has no effect?
Thank you for your help.
Advanced Edit:
After the scheduled summary index ran on a scheduled time, the latest search on "view recent" still showed "addtime=t", instead of "addtime=f"
addtime=false worked if I ran it manually
hi @LearningGuy
I believe it's due to the collect commands used for scheduled summary indexing.
More on this can be found here.
https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/Knowledge/Configuresummaryindexes#Other_c...
https://docs.splunk.com/Documentation/Splunk/9.2.0/SearchReference/Collect
If the reply helps, a Karma upvote would be appreciated.