topic How to create a timechart based on index time? in Splunk Search

How to create a timechart based on index time?

DEAD_BEEF — Mon, 27 Aug 2018 14:20:44 GMT

I'm trying to create a timechart to show when logs were ingested. Trying to use _indextime but it doesn't seem to be working. What am I missing on my SPL?

Current query

index=web
| eval _time=strptime(_indextime, "%d-%b-%y %H:%M:%S") 
| timechart span=1h count by index

Re: How to create a timechart based on index time?

FrankVl — Mon, 27 Aug 2018 14:29:13 GMT

You shouldn't be putting a formatted string timestamp into _time. Splunk expects an epoch timestamp there (even though it usually presents _time automatically as a human readable string). So just try eval _time = _indextime.

Re: How to create a timechart based on index time?

skoelpin — Mon, 27 Aug 2018 15:01:16 GMT

Try strftime instead

index=web
 | eval indextime=strftime(_indextime, "%d-%b-%y %H:%M:%S") 
 | timechart span=1h max(indextime) by index

If you wanted to identify indexing lag, you can do this

    index=web
   | eval indextime=strftime(_indextime, "%s") 
   | eval diff=indextime-_time
   | timechart span=1h max(diff) AS diff

Re: How to create a timechart based on index time?

DalJeanis — Mon, 27 Aug 2018 15:10:48 GMT

_indextime is already in epoch. No conversion is needed.

 | eval  _time = _indextime