https://community.splunk.com/t5/Getting-Data-In/Does-splunk-store-the-datetime-each-specific-event-was-indexed/m-p/127187#M26177 <P>Hi @ruiaires</P> <P>Yup!</P> <P>"The _indextime field contains the time that an event was indexed, expressed in Unix time. You might use this field to focus on or filter out events that were indexed within a specific range of time."</P> <P>Check out the docs on other internal fields here<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/UseDefaultFields#Internal_fields">http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/UseDefaultFields#Internal_fields</A></P> Wed, 19 Nov 2014 17:28:22 GMT ppablo 2014-11-19T17:28:22Z https://community.splunk.com/t5/Getting-Data-In/Does-splunk-store-the-datetime-each-specific-event-was-indexed/m-p/127186#M26176 <P>Sometimes, when troubleshooting inputs on large installations (deployment apps, several layers of forwarders, etc), it would be nice to know when a specific event was actually indexed on splunk... It would be also useful when adding historic data (old data on file) and get a notion that it was not indexed "as it was generated" or when the original source process (that writes on a log file) does this by "bursts" instead of "near-real-time"</P> <P>It would be very simple just to store something like a "_indexedtime" field on every event.<BR /> Is there any debug setting to turn this on ?</P> Wed, 19 Nov 2014 17:07:43 GMT https://community.splunk.com/t5/Getting-Data-In/Does-splunk-store-the-datetime-each-specific-event-was-indexed/m-p/127186#M26176 ruiaires 2014-11-19T17:07:43Z https://community.splunk.com/t5/Getting-Data-In/Does-splunk-store-the-datetime-each-specific-event-was-indexed/m-p/127187#M26177 <P>Hi @ruiaires</P> <P>Yup!</P> <P>"The _indextime field contains the time that an event was indexed, expressed in Unix time. You might use this field to focus on or filter out events that were indexed within a specific range of time."</P> <P>Check out the docs on other internal fields here<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/UseDefaultFields#Internal_fields">http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/UseDefaultFields#Internal_fields</A></P> Wed, 19 Nov 2014 17:28:22 GMT https://community.splunk.com/t5/Getting-Data-In/Does-splunk-store-the-datetime-each-specific-event-was-indexed/m-p/127187#M26177 ppablo 2014-11-19T17:28:22Z