Hello,
I am overwriting _time in datamodel because there is no proper timestamp in logs. when I am trying to access data using tstat search, _time is not sync with time picker.
In below screen shot I have attached 2 search
1) when I select All time, data is there with updated time as per defined in datamodel.
2) when I narrow down in time picker I can't see any data.
![alt text][1]
Overwrite _time in datamodel
![alt text][2]
[1]: /storage/temp/256680-update-time.png
[2]: /storage/temp/256681-data-model.png
↧