Is there a timestamp or any metadata stored about when an event was summarized for datamodel summary ?
I'm looking for something like the _it field.
Or is there any other way to look at what was the delay between an event being indexed in Splunk and being summarized?
↧