OK, this is driving me crazy. I have a normal time in _time (displayed as yyyy-mm-dd HH:MM:SS). I collect it into an index without any bin. I search on the index, and the times are all yyyy-mm-dd HH:00:00 or yyyy-mm-dd HH:00:01. In addition, the number of events with the time yyyy-mm-dd HH:00:00 are various multiples of 100,000, as if there's a limitation being reached, but the multiple isn't the same.
I can copy the _time variable to another one, and it will be in the index exactly as I expect (displayed as epoch time with microsecond precision) from the index. But that AFAIK can't be used in, e.g., timechart. (And as this index is for users to run statistics on, copying it back to _time isn't an option.)
As I was researching this I came across a comment about sub-second times possibly creating a need for too much memory, but (a) I can't find it again, and (b) I would have thought that one would lose subsecond precision, not (in my case) hourly.
Any help would be appreciated!
... View more