Hi!
I would like to know how to create info_time_min fields in collect command.
Are there any special conditions to meet to fill in this field?
Thanks,
Yu
Use addinfo
. See the docs on both collect
and addinfo
.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Collect
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Addinfo