Getting Data In

Showing indexed time?

msarro
Builder

Hey everyone,
Is there a way to show the indexed time of an event (as opposed to the timestamp)? I am trying to see if my forwarders are capable of keeping up with the volume of data that I am sending - I seem to be missing a lot of events and I want to make sure I'm not losing them when my pruning process runs.

Tags (1)

Lowell
Super Champion

Look at the hidden _indextime field. I've found it helpful to look at the delay of each event and chart the results like so:

your search ... | eval delay=_indextime-_time | bucket bins=30 delay | chart count by delay

mendesjo
Path Finder

Doesn't work for me 😞 I add this to a query and I do not see _indextime values,

0 Karma

mendesjo
Path Finder

Here is the answer
YOUR QUERY | eval lag_sec=_indextime-_time | table lag_sec

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

This data is stored in the _indextime field.

You can access it via:

... | eval indexed_time=strftime(_indextime, "%+")

Or:

... | eval lag = _indextime - _time
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...