topic Re: How to generate a search for new events based on index time not event timestamp? in Splunk Search

How to generate a search for new events based on index time not event timestamp?

techols — Wed, 17 May 2017 19:47:34 GMT

I want to build a system where an external event consumer periodically pulls newly indexed events from Splunk on a scheduled basis (e.g., every 15 or 30 minutes, or hourly). The concern I have is that the indexing of events by Splunk can be interrupted due to licensing issues or due to network or server issues where a forwarder is temporarily prevented from sending events. When the forwarding or indexing of events is restored, we will be indexing old events with timestamps set by the props.conf to the old times.

So in queries from the external system, I want it to be able to query for events indexed in the last X minutes independent of the event timestamp. This will allow me to pick up old events that were recently indexed without overly complex queries. Is this concept possible to implement in Spunk?

Re: How to generate a search for new events based on index time not event timestamp?

woodcock — Thu, 18 May 2017 02:54:14 GMT

There are the _index_earliest and _index_latest directives, like this:

index=* _index_earliest="-10m@m" _index_latest=now()

https://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/SearchTimeModifiers

Re: How to generate a search for new events based on index time not event timestamp?

techols — Thu, 18 May 2017 13:31:57 GMT

Thanks! Sounds like that would work.

Re: How to generate a search for new events based on index time not event timestamp?

woodcock — Thu, 18 May 2017 14:55:45 GMT

Be sure to click Accept when it does! 😆