https://community.splunk.com/t5/Getting-Data-In/timestsamp-when-data-was-ingested/m-p/446473#M77657 <P>When we have ingested wrong timestamps, is there a way to find the timestamp of WHEN the data was ingested, not the _time field?</P> Wed, 14 Aug 2019 13:56:57 GMT wfskmoney 2019-08-14T13:56:57Z https://community.splunk.com/t5/Getting-Data-In/timestsamp-when-data-was-ingested/m-p/446473#M77657 <P>When we have ingested wrong timestamps, is there a way to find the timestamp of WHEN the data was ingested, not the _time field?</P> Wed, 14 Aug 2019 13:56:57 GMT https://community.splunk.com/t5/Getting-Data-In/timestsamp-when-data-was-ingested/m-p/446473#M77657 wfskmoney 2019-08-14T13:56:57Z https://community.splunk.com/t5/Getting-Data-In/timestsamp-when-data-was-ingested/m-p/446474#M77658 <P>There is a hidden field called <CODE>_indextime</CODE> that you can use for this. </P> Wed, 14 Aug 2019 14:09:21 GMT https://community.splunk.com/t5/Getting-Data-In/timestsamp-when-data-was-ingested/m-p/446474#M77658 traxxasbreaker 2019-08-14T14:09:21Z https://community.splunk.com/t5/Getting-Data-In/timestsamp-when-data-was-ingested/m-p/446475#M77659 <P>The _indextime field shows when an event was ingested. It's a hidden field, though, so you'll have to assign its value to another field to view it. <CODE>| eval indextime = _indextime | table _time indextime</CODE>.</P> Wed, 14 Aug 2019 14:10:17 GMT https://community.splunk.com/t5/Getting-Data-In/timestsamp-when-data-was-ingested/m-p/446475#M77659 richgalloway 2019-08-14T14:10:17Z