https://community.splunk.com/t5/Splunk-Search/Is-indextime-deprecated/m-p/22055#M3736 <P>I'm trying to see if a clock is off on some of my servers and I want to compare the _time field with the time the event was indexed. From looking around, I thought that _indextime was supposed to give me that. But that field isn't available in my data...</P> <P>How do I find out when Splunk indexed an event?</P> <P>Thx.</P> <P>C</P> Fri, 02 Nov 2012 19:47:27 GMT responsys_cm 2012-11-02T19:47:27Z https://community.splunk.com/t5/Splunk-Search/Is-indextime-deprecated/m-p/22055#M3736 <P>I'm trying to see if a clock is off on some of my servers and I want to compare the _time field with the time the event was indexed. From looking around, I thought that _indextime was supposed to give me that. But that field isn't available in my data...</P> <P>How do I find out when Splunk indexed an event?</P> <P>Thx.</P> <P>C</P> Fri, 02 Nov 2012 19:47:27 GMT https://community.splunk.com/t5/Splunk-Search/Is-indextime-deprecated/m-p/22055#M3736 responsys_cm 2012-11-02T19:47:27Z https://community.splunk.com/t5/Splunk-Search/Is-indextime-deprecated/m-p/22056#M3737 <P><CODE>_indextime</CODE> is definitely not deprecated. To get it to show, you must rename it to a field name that doesn't begin with an underscore.</P> Fri, 02 Nov 2012 20:31:46 GMT https://community.splunk.com/t5/Splunk-Search/Is-indextime-deprecated/m-p/22056#M3737 Stephen_Sorkin 2012-11-02T20:31:46Z