topic From _raw events I do not see _indextime in Splunk Search

From _raw events I do not see _indextime

lpolo — Wed, 22 Apr 2020 13:04:47 GMT

I am wondering why from some set of _raw indexes I do not see _indextime. I should see it. Any idea?

Thanks,
Lp

Re: From _raw events I do not see _indextime

gcusello — Wed, 22 Apr 2020 13:22:23 GMT

Hi @lpolo,
_indextime isn't a field displayed by default (I don't know why!), but it's always present, if you want it you must explicitate it using table or eval to display in human readable format:

index=my_index
| eval indextime=strftime(_indextime,"%d/%m/%Y %H:%M:%S")
| table _time indextime _raw

Ciao.
Giuseppe

Re: From _raw events I do not see _indextime

lpolo — Wed, 22 Apr 2020 13:38:22 GMT

Thanks!
I am aware that it should always be present that is the reason of my question. I am wondering why some indexes I can see it with this simple query:

index=myindex| table _time _indextime

But with some other indexes I need to do this to see it:
index=myindex | eval indextime=_indextime | table _time indextime _indextime

Re: From _raw events I do not see _indextime

lpolo — Wed, 22 Apr 2020 13:39:59 GMT

Grazie Mille Giuseppe. Forza Italia. 🙂

Re: From _raw events I do not see _indextime

gcusello — Wed, 22 Apr 2020 13:46:25 GMT

You're welcome".
if you're staisfied by this answer, please accept and/or upvote it, for the other memebers of the Community.

sempre!
Ciao.
Giuseppe