Where does Splunk keep metadata on when a log was indexed?

[kalik]

The logs I've got only have log generation timestamps in them, and the timestamp in Splunk reflects the log generation date. Does Splunk keep metadata on when a specific log was delivered/acquired from the forwarder/host? If it does, how can I get that metadata?

[esix_splunk · Accepted solution]

Splunk wont keep the this information, per se, in metadata. Your best way to approach this would be to look at the index time of the event and compare that to the timestamp of the event. Thats about as close as you can get from seeing the different of when the event arrived and was indexed vs what the timestamp of the event is.

This field is stored in field called "_indextime".

... | eval ingesttime=_indextime | table ingesttime

[pradeepkumarg]

You can look at _indextime to know when a particular event was actually indexed

Add this to your search

 | convert ctime(_indextime) as INDEX_TIME