Getting Data In

Filter by Index Time

Path Finder

I added Apache logs from 2 webservers to Splunk in two batches a week apart. Dropped the files in a folder that I have Splunk watching so it doesn't know where they really came from. File names are all the same (should have changed them but didn't).

How do I filter logs from web-1 only? I was thinking that I could filter on indexed time but can't find a field for that value. Any ideas?

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

You can add indexed time to your search result by something like this

index=yourindex sourcetype=your sourcetype | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")

View solution in original post

SplunkTrust
SplunkTrust

You can add indexed time to your search result by something like this

index=yourindex sourcetype=your sourcetype | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")

View solution in original post

Path Finder

Thanks to both. Good info. Didn't know _indextime was a field. Added this to my search did it
_indextime<1396310400

0 Karma

Legend

If you want to filter on index time just like you would with timestamp, use the _index_earliest and _index_latest terms.