How to set the time events were indexed as the event timestamp, not the time the logs were written?

[nmaiorana]

I would like to read log data by the time the log was ingested, not the time the log was written. For example, give me logs ingested by Splunk in the last 30 seconds. This is almost like a real-time ingestion, except I'm not looking at the log entry time.

[sundareshr · Accepted solution]

See if this gives you what you're looking for

http://blogs.splunk.com/2013/09/26/an-introduction-to-the-theory-or-relative-time-modifiers-for-_ind...

[nmaiorana]

I can't get to the link provided.

Thanks

[nmaiorana]

That's it! Thank you.