topic include indexTime in output file in Splunk Search

include indexTime in output file

efelder0 — Wed, 30 May 2012 14:16:02 GMT

I am looking to include the indexTime in my output file and then append that that field to an existing 'CreateTimeStamp' field. What is the best method to extract indexTime (or recentTime)?

Re: include indexTime in output file

Ayn — Wed, 30 May 2012 14:36:41 GMT

Not sure what your "output file" is, but here goes:

The time an event was indexed is available in the field _indextime. You might have some problems with actually viewing it because it's by default a purely internal field that isn't shown to users. You can however make it visible by eval:ing it:

 ... | eval indextime=_indextime

After that you can just include the indextime field in whatever output you need.

Re: include indexTime in output file

mslvrstn — Wed, 29 Aug 2012 16:56:39 GMT

Ayn, I combined this with your other answer
http://splunk-base.splunk.com/answer_link/41401/
about getting readable times, to get
| eval indextime=strftime(_indextime,"%+")

Thanks for both excellent answers!