topic Re: Filter by Index Time in Getting Data In

Filter by Index Time

motobeats — Wed, 02 Apr 2014 17:05:09 GMT

I added Apache logs from 2 webservers to Splunk in two batches a week apart. Dropped the files in a folder that I have Splunk watching so it doesn't know where they really came from. File names are all the same (should have changed them but didn't).

How do I filter logs from web-1 only? I was thinking that I could filter on indexed time but can't find a field for that value. Any ideas?

Re: Filter by Index Time

somesoni2 — Wed, 02 Apr 2014 17:34:34 GMT

You can add indexed time to your search result by something like this

index=yourindex sourcetype=your sourcetype | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")

Re: Filter by Index Time

Ayn — Wed, 02 Apr 2014 18:42:18 GMT

If you want to filter on index time just like you would with timestamp, use the _index_earliest and _index_latest terms.

Re: Filter by Index Time

motobeats — Wed, 02 Apr 2014 19:12:25 GMT

Thanks to both. Good info. Didn't know _indextime was a field. Added this to my search did it
_indextime<1396310400