Splunk Search

Datamodel is giving results outside of the constraints given in Summary Range

jshah24
Explorer

I have accelerated my data model for 7 days period and Rebuild the datamodel.
After its completion, I have executed below query to get the acceleration period which is mentioned in https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Acceleratedatamodels document under "Using the summariesonly argument" section.

| tstats summariesonly=t min(_time) as min, max(_time) as max from datamodel=mydm | eval prettymin=strftime(min, "%c") | eval prettymax=strftime(max, "%c")

As per my understanding, prettymin should be 7 days older from the current date but it is showing the timestamp which corresponds to the index time of the very first event (which in my case is approx a month ago.)

Please, help me understand this behavior and let me know if any changes are required to show results in the specified summary range?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...