Getting Data In

How do I determine when an event was indexed?

the_wolverine
Champion

I'm trying to troubleshoot some issues with indexing. It would be great to be able to find out when an event or events were indexed.

1 Solution

the_wolverine
Champion

Here's how I would do it:

searchterms | eval idxtime=_indextime | convert ctime(idxtime) 

The added step of converting using ctime changes the epochtime (of _indextime) to human readable ascii time, like "03/31/2010 20:30:00".

View solution in original post

lisaac
Path Finder

I have a question. What is the easiest way to export this data from the command line? I would like the raw event with the value idxtime.

0 Karma

the_wolverine
Champion

Here's how I would do it:

searchterms | eval idxtime=_indextime | convert ctime(idxtime) 

The added step of converting using ctime changes the epochtime (of _indextime) to human readable ascii time, like "03/31/2010 20:30:00".

the_wolverine
Champion

you rock.......

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

one step: mysearchterms | convert ctime(_indextime) as idxtime

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

Since Splunk 4.0, the indexing machine will add an index time field called _indextime to events as they are written to disk. To see these, run a search like the following and add "indextime" to the selected fields:

... | eval indextime = _indextime

To calculate lag from the timestamp of the event through indexing, search like:

... | eval lag = _indextime - _time

Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...