Getting Data In
Highlighted

How to extract timestamp for one index out of multiple index which having only one sourcetype?

New Member

Hi All,

Could you please let me know how to extract _time for from fields for one index out of multiple index which using one sourcetpe ?

like having indexes a,b,c,d,e and sourcetype =s1 ,here time stamp extraction has to be done for only one index b.

means I am looking for index based timestamp extraction

Thanks
Rakesh

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.