All Apps and Add-ons
Highlighted

Report for event timestamp & indexed timestamp

Builder

Hey Guys -

I am looking to create a simple report with event timestamp & indexed timestamp information but not able to merge index=xxx & index=_internal. Could someone please help me with search. You may consider any sample data.

Thanks in advance.

Tags (2)
0 Karma
Highlighted

Re: Report for event timestamp & indexed timestamp

SplunkTrust
SplunkTrust

Hello,

Please try this:

 ... | eval indexed_time=strftime(_indextime, "%+") | table indexed_time _time

There isnt a need to combine both indexes as there is always a hidden internal field called _indextime.

You might also find this post helpful: https://answers.splunk.com/answers/42646/showing-indexed-time.html

View solution in original post

0 Karma
Highlighted

Re: Report for event timestamp & indexed timestamp

Builder

Is there anyway to include timestamp for data read by UF as well?

Thanks

0 Karma
Highlighted

Re: Report for event timestamp & indexed timestamp

SplunkTrust
SplunkTrust
0 Karma