topic Where does Splunk keep metadata on when a log was indexed? in Getting Data In

Where does Splunk keep metadata on when a log was indexed?

kalik — Thu, 15 Dec 2016 00:30:37 GMT

The logs I've got only have log generation timestamps in them, and the timestamp in Splunk reflects the log generation date. Does Splunk keep metadata on when a specific log was delivered/acquired from the forwarder/host? If it does, how can I get that metadata?

Re: Where does Splunk keep metadata on when a log was indexed?

pradeepkumarg — Tue, 29 Sep 2020 12:08:06 GMT

You can look at _indextime to know when a particular event was actually indexed

Add this to your search

 | convert ctime(_indextime) as INDEX_TIME

Re: Where does Splunk keep metadata on when a log was indexed?

esix_splunk — Thu, 15 Dec 2016 03:18:19 GMT

Splunk wont keep the this information, per se, in metadata. Your best way to approach this would be to look at the index time of the event and compare that to the timestamp of the event. Thats about as close as you can get from seeing the different of when the event arrived and was indexed vs what the timestamp of the event is.

This field is stored in field called "_indextime".

... | eval ingesttime=_indextime | table ingesttime