topic Re: Event received time vs parsed event time in Getting Data In

Event received time vs parsed event time

alexander_lucas — Tue, 06 Sep 2011 02:20:33 GMT

Dears,

Are there separate fields for:

Event received time (when event was received by Splunk); and

Parsed (extracted) event time?

My understanding is that for any events that have a recognisable timestamp Splunk will try to extract it at index time and store in the _time internal field (as epoch time).

Then at search time Spunk dynamically creates date_* fields. What I would like to know if there is another field that contains event received time (regardless of the event content, extractions etc) ?

Re: Event received time vs parsed event time

gkanapathy — Tue, 06 Sep 2011 02:37:39 GMT

There is a field _indextime on each event that indicates when an event was indexed.

Re: Event received time vs parsed event time

araitz — Tue, 06 Sep 2011 04:26:03 GMT

To make it viewable, add to your search: | eval indextime=_indextime

Re: Event received time vs parsed event time

alexander_lucas — Wed, 07 Sep 2011 02:24:58 GMT

thank you gk and araitz