t_event_time
to each log which maps to the log’s
corresponding event time. That lets you query over logs from multiple data
sources using t_event_time
to properly align and correlate despite their
disparate schemas.
We append the below fields to every log record:
t_event_time
: The event time for the log, normalized to UTCt_parse_time
: The time when the event was parsed, normalized to UTC. If an event does not have a timestamp, thent_event_time
will be set tot_parse_time
t_ip_address
: IP address for the log source. Even if one source defines an ip address field asipAddr
, and another defines it assrcIpAddress
, you can query across both by searching fort_ip_address
.t_email_address
: Actor email address.