Filter by Index Time

[motobeats]

I added Apache logs from 2 webservers to Splunk in two batches a week apart. Dropped the files in a folder that I have Splunk watching so it doesn't know where they really came from. File names are all the same (should have changed them but didn't).

How do I filter logs from web-1 only? I was thinking that I could filter on indexed time but can't find a field for that value. Any ideas?

[somesoni2 · Accepted solution]

You can add indexed time to your search result by something like this

index=yourindex sourcetype=your sourcetype | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")

[motobeats]

Thanks to both. Good info. Didn't know _indextime was a field. Added this to my search did it
_indextime<1396310400

[Ayn]

If you want to filter on index time just like you would with timestamp, use the _index_earliest and _index_latest terms.