Hi,
I have two different sourcetypes, and I noticed that one of them always has a "time" field, and another has a _time field. Neither one are provided by the vendor, or are key-value pairs, so I'm wondering how/why Splunk creates these fields?
↧