Splunk using info_min_time as timestamp instead of _raw

Question

I am having the following Splunk query to forward some data to a Splunk Summary index:-

index=* eventId="USER_LOGIN_SUCCESS" userRole!=*FF_* userType!="FirstFuel" sourcetype="firstengage" 
| eval datetime=strftime(_time, "%Y-%m-%d %H:%M:%S")  
| eval isFirstTimeLogin=if(isFirstTimeLogin!="",isFirstTimeLogin,"false") 
| eval marketSegment=if(marketSegment!="",marketSegment,"N/A") 
| eval userIdOrName=login 
| table _time,userIdOrName , userRole,  isFirstTimeLogin, tenantName, datetime ,marketSegment 
| summaryindex spool=t uselb=t addtime=false index="sites_visit_dashboard_login_details" file="RMD554abaf058283f90c_1178469630.stash_new" name="Site visits Dashboard login details" marker="forceCsvResults=\"auto\""

But when I am checking the forwarded events in Splunk, it has a timestamp of min date from all those events instead of using the timestamp for the corresponding events. I am not sure why it is not using the time specified by _raw. Please let me know if I am missing something here

Answer 1

Splunk does not have a summaryindex command. The command to write to a summary index is collect.

Since Splunk looks for info_min_time before _time when writing to a summary index, try discarding info_min_time to force _time to be used.

index=* eventId="USER_LOGIN_SUCCESS" userRole!=*FF_* userType!="FirstFuel" sourcetype="firstengage" 
| eval datetime=strftime(_time, "%Y-%m-%d %H:%M:%S")  
| eval isFirstTimeLogin=if(isFirstTimeLogin!="",isFirstTimeLogin,"false") 
| eval marketSegment=if(marketSegment!="",marketSegment,"N/A") 
| eval userIdOrName=login 
| table _time,userIdOrName , userRole,  isFirstTimeLogin, tenantName, datetime ,marketSegment 
| fields - info_min_time
| collect spool=t addtime=false index="sites_visit_dashboard_login_details" file="RMD554abaf058283f90c_1178469630.stash_new" name="Site visits Dashboard login details" marker="forceCsvResults=\"auto\""