Getting Data In

How do I determine when an event was indexed?

the_wolverine
Champion

I'm trying to troubleshoot some issues with indexing. It would be great to be able to find out when an event or events were indexed.

1 Solution

the_wolverine
Champion

Here's how I would do it:

searchterms | eval idxtime=_indextime | convert ctime(idxtime) 

The added step of converting using ctime changes the epochtime (of _indextime) to human readable ascii time, like "03/31/2010 20:30:00".

View solution in original post

lisaac
Path Finder

I have a question. What is the easiest way to export this data from the command line? I would like the raw event with the value idxtime.

0 Karma

the_wolverine
Champion

Here's how I would do it:

searchterms | eval idxtime=_indextime | convert ctime(idxtime) 

The added step of converting using ctime changes the epochtime (of _indextime) to human readable ascii time, like "03/31/2010 20:30:00".

the_wolverine
Champion

you rock.......

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

one step: mysearchterms | convert ctime(_indextime) as idxtime

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

Since Splunk 4.0, the indexing machine will add an index time field called _indextime to events as they are written to disk. To see these, run a search like the following and add "indextime" to the selected fields:

... | eval indextime = _indextime

To calculate lag from the timestamp of the event through indexing, search like:

... | eval lag = _indextime - _time

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...