Getting Data In

How do I determine when an event was indexed?

Champion

I'm trying to troubleshoot some issues with indexing. It would be great to be able to find out when an event or events were indexed.

1 Solution

Champion

Here's how I would do it:

searchterms | eval idxtime=_indextime | convert ctime(idxtime) 

The added step of converting using ctime changes the epochtime (of _indextime) to human readable ascii time, like "03/31/2010 20:30:00".

View solution in original post

Path Finder

I have a question. What is the easiest way to export this data from the command line? I would like the raw event with the value idxtime.

0 Karma

Champion

Here's how I would do it:

searchterms | eval idxtime=_indextime | convert ctime(idxtime) 

The added step of converting using ctime changes the epochtime (of _indextime) to human readable ascii time, like "03/31/2010 20:30:00".

View solution in original post

Champion

you rock.......

0 Karma

Splunk Employee
Splunk Employee

one step: mysearchterms | convert ctime(_indextime) as idxtime

0 Karma

Splunk Employee
Splunk Employee

Since Splunk 4.0, the indexing machine will add an index time field called _indextime to events as they are written to disk. To see these, run a search like the following and add "indextime" to the selected fields:

... | eval indextime = _indextime

To calculate lag from the timestamp of the event through indexing, search like:

... | eval lag = _indextime - _time

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!