Getting Data In

Filter by Index Time

Path Finder

I added Apache logs from 2 webservers to Splunk in two batches a week apart. Dropped the files in a folder that I have Splunk watching so it doesn't know where they really came from. File names are all the same (should have changed them but didn't).

How do I filter logs from web-1 only? I was thinking that I could filter on indexed time but can't find a field for that value. Any ideas?

Tags (1)
0 Karma
1 Solution

Revered Legend

You can add indexed time to your search result by something like this

index=yourindex sourcetype=your sourcetype | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")

View solution in original post

Revered Legend

You can add indexed time to your search result by something like this

index=yourindex sourcetype=your sourcetype | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")

View solution in original post

Path Finder

Thanks to both. Good info. Didn't know _indextime was a field. Added this to my search did it
_indextime<1396310400

0 Karma

Legend

If you want to filter on index time just like you would with timestamp, use the _index_earliest and _index_latest terms.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!