Splunk.intersplunk: Receiving error "could not locate the time (_time) field..."

[santosm]

How come I can't locate the time (_time) field on some results returned from the external search command?

Hi,

I use Splunk.Intersplunk library to do my search command, but sometimes output receives the error:
"could not locate the time (_time) field on some results returned from the external search command".

Does anyone know why this is happening?

[VatsalJagani]

Hello @santosm,

Recently I came across this issue and I found out that if you use your command as streaming command you need to return _time field. So you can get this field from results streamed to the command and returned with other fields.