How come I can't locate the time (_time) field on some results returned from the external search command?
Hi,
I use Splunk.Intersplunk library to do my search command, but sometimes output receives the error:
"could not locate the time (_time) field on some results returned from the external search command".
Does anyone know why this is happening?
Hello @santosm,
Recently I came across this issue and I found out that if you use your command as streaming command you need to return _time field. So you can get this field from results streamed to the command and returned with other fields.