Data ingestion vs creation
Data in Devo is indexed by ingestion time (eventdate) by default, which means that filtering and grouping by the event date are optimized. With this new feature, we have added a new time index over the creation time of the events (creationdate field), so queries over this field are also optimized.
The event date is when Devo receives and ingests data. On the other hand, the creation date is considered as when data is generated at its source. For this reason, the event date is always after the creation date, although in many cases there is a negligible difference between both. Sometimes there is a large difference between both dates and a user is interested in the creation date being the time reference for their data. For example, imagine a machine that generates events, which is then switched off for a whole day and the events arrive in Devo the next day: in this case the event date and creation date would differ.
Time control in the search window
Limited availability
This feature has limited availability. If you have any doubts or questions do not hesitate to reach out to us.
Provided you have the required Time control permission, the time control button is located to the left of the date picker in the search window and serves as a visual indicator of whether time control is activated, as well as which time reference you are using for your table.
Switching not recommended
We recommend you refrain from switching between both time reference options when running queries as the results returned might not be correct. If you need to use the other option, we recommend running a new search instead.
Once activated, use this button to select the time reference for your current search:
Creation date mode (CrD): This sets the creation date as the time reference for the current search.
Ingestion date mode (InD): This sets the event date as the time reference for the current search. Note that this is the default in Devo.
Get more information about the time control feature in this article.
