Getting Data In

Filter by Index Time

motobeats
Path Finder

I added Apache logs from 2 webservers to Splunk in two batches a week apart. Dropped the files in a folder that I have Splunk watching so it doesn't know where they really came from. File names are all the same (should have changed them but didn't).

How do I filter logs from web-1 only? I was thinking that I could filter on indexed time but can't find a field for that value. Any ideas?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

You can add indexed time to your search result by something like this

index=yourindex sourcetype=your sourcetype | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")

View solution in original post

somesoni2
Revered Legend

You can add indexed time to your search result by something like this

index=yourindex sourcetype=your sourcetype | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")

motobeats
Path Finder

Thanks to both. Good info. Didn't know _indextime was a field. Added this to my search did it
_indextime<1396310400

0 Karma

Ayn
Legend

If you want to filter on index time just like you would with timestamp, use the _index_earliest and _index_latest terms.

Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...