Getting Data In
Highlighted

Where does Splunk keep metadata on when a log was indexed?

Explorer

The logs I've got only have log generation timestamps in them, and the timestamp in Splunk reflects the log generation date. Does Splunk keep metadata on when a specific log was delivered/acquired from the forwarder/host? If it does, how can I get that metadata?

0 Karma
Highlighted

Re: Where does Splunk keep metadata on when a log was indexed?

Influencer

You can look at _indextime to know when a particular event was actually indexed

Add this to your search

 | convert ctime(indextime) as INDEXTIME

0 Karma
Highlighted

Re: Where does Splunk keep metadata on when a log was indexed?

Splunk Employee
Splunk Employee

Splunk wont keep the this information, per se, in metadata. Your best way to approach this would be to look at the index time of the event and compare that to the timestamp of the event. Thats about as close as you can get from seeing the different of when the event arrived and was indexed vs what the timestamp of the event is.

This field is stored in field called "_indextime".

... | eval ingesttime=_indextime | table ingesttime

View solution in original post