topic Re: "Last 15 min" - refers to event time or index time ? in Splunk Search

"Last 15 min" - refers to event time or index time ?

splunker12er — Fri, 08 Aug 2014 08:35:08 GMT

"Last 15 minutes" - Is this referring to index time (or) Events time ?

I have hosts located in different timezones, and my Search head & indexers running in GMT TZ.
So,when I do a search for say.,"Last 15 min" , this refers to GMT's timezones last 15 minute ?

I am referring to this since, i might miss data in my search result as host's event time are in their native TZ format which will not be shown for my search

Re: "Last 15 min" - refers to event time or index time ?

martin_mueller — Fri, 08 Aug 2014 08:45:59 GMT

That refers to the event's time, namely the _time field.

All times in the UI are in the Splunk user's timezone, which defaults to the Search Head timezone.
For indexing other timezones where the event doesn't specify the timezone you can set the timezone for a host in props.conf like this:

[host::some_host]
TZ = timezone

See http://docs.splunk.com/Documentation/Splunk/6.1.3/Admin/propsconf for reference.

If you want to search for the last 15 minutes by index time you can search over all time using this:

_index_earliest=-15m _index_latest=now actual search goes here

Re: "Last 15 min" - refers to event time or index time ?

strive — Mon, 28 Sep 2020 17:17:40 GMT

Martin has answered your question.

Suppose if you need index time. Use _indextime field.

Example:
index= your_index earliest=-10m@m | dedup _indextime | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S") | table indextime