topic Re: How do I determine when an event was indexed? in Getting Data In

How do I determine when an event was indexed?

the_wolverine — Fri, 02 Apr 2010 02:38:30 GMT

I'm trying to troubleshoot some issues with indexing. It would be great to be able to find out when an event or events were indexed.

Re: How do I determine when an event was indexed?

Stephen_Sorkin — Fri, 02 Apr 2010 02:46:00 GMT

Since Splunk 4.0, the indexing machine will add an index time field called _indextime to events as they are written to disk. To see these, run a search like the following and add "indextime" to the selected fields:

... | eval indextime = _indextime

To calculate lag from the timestamp of the event through indexing, search like:

... | eval lag = _indextime - _time

Re: How do I determine when an event was indexed?

the_wolverine — Fri, 02 Apr 2010 04:34:39 GMT

Here's how I would do it:

searchterms | eval idxtime=_indextime | convert ctime(idxtime)

The added step of converting using ctime changes the epochtime (of _indextime) to human readable ascii time, like "03/31/2010 20:30:00".

Re: How do I determine when an event was indexed?

gkanapathy — Fri, 02 Apr 2010 10:36:08 GMT

one step: mysearchterms | convert ctime(_indextime) as idxtime

Re: How do I determine when an event was indexed?

the_wolverine — Fri, 02 Apr 2010 13:01:21 GMT

you rock.......

Re: How do I determine when an event was indexed?

lisaac — Sat, 09 Oct 2010 00:01:12 GMT

I have a question. What is the easiest way to export this data from the command line? I would like the raw event with the value idxtime.