Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
153 changes: 70 additions & 83 deletions docs/search/get-started-with-search/build-search/dynamic-parsing.md

Large diffs are not rendered by default.

Original file line number Diff line number Diff line change
@@ -1,25 +1,35 @@
---
id: use-receipt-time
title: Use Receipt Time
description: You can display search results in the order that the Collector received the messages in milliseconds.
description: Enable the Use Receipt Time feature to display search results in the order that the Collector received the messages in milliseconds.
---

import useBaseUrl from '@docusaurus/useBaseUrl';

<!-- When Intelliparse goes GA, update this doc to reflect new Search Config...

Parsing
* Intelliparse
* Auto Parse
* Manual

Timestamp
* Message Time
* Receipt Time
-->

By default, log searches run by Message time. Enable the **Use Receipt Time** setting to run the search by Receipt time, which is the timestamp when a log message hits the Sumo Logic receivers.

To search data based on the order that Collectors received the messages use **Receipt Time**. This option has the search reference the [metadata](../search-basics/built-in-metadata.md) field `_receiptTime` instead of `_messageTime`, giving you the ability to view the difference in the parsed [timestamp](/docs/send-data/reference-information/time-reference) (`_messageTime`) and receipt time (`_receiptTime`) to pinpoint Sources that may be parsing the message's timestamps incorrectly.

## Run a search by Receipt Time

To run a search by Receipt Time:
To run a log search by Receipt Time:

1. Enter your query in the search text box.
1. Choose the Time Range for the query.
1. Click the gear icon to open the **Search Config** menu and toggle **Use Receipt Time** on.

![receipt time option.png](/img/search/get-started-search/build-search/receipt-time-option.png)

1. Review the search results for wide discrepancies between message timestamp and receipt time to pinpoint Sources with incorrect timestamps:

![receipt time results in messages tab.png](/img/search/get-started-search/build-search/receipt-time-results-messages-tab.png)
1. Click the gear icon to open the **Search Config** menu and toggle on **Use Receipt Time**.<br/><img src={useBaseUrl('img/search/get-started-search/build-search/receipt-time-option.png')} alt="receipt time option.png" style={{border: '1px solid gray'}} width="450"/>
1. Review the search results for wide discrepancies between message timestamp and receipt time to pinpoint Sources with incorrect timestamps:<br/><img src={useBaseUrl('img/search/get-started-search/build-search/receipt-time-results-messages-tab.png')} alt="receipt time results in messages tab.png" width="700"/>

## Resolving timestamp/receipt time issues

Expand Down
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file not shown.
Binary file not shown.