Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

_time resolution in Summary Index

$
0
0

The following query construct populates a summary index:

source=1.log OR source=2.log |
eval _time = case(source == "1.log", _time)|
stats 
 first(_time)  as _time 
….other fileds….
 dc(source) as dc by id|search dc=2

The resolution _time of the time stamp for each source log is in milliseconds. Example : 2013-06-13 04:00:15,250

Question: Why isn’t the resolution time in the summary index in mill. seconds (e.g., 2013-06-13 04:00:15 +0000)?


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>