timestsamp when data was ingested

[wfskmoney]

When we have ingested wrong timestamps, is there a way to find the timestamp of WHEN the data was ingested, not the _time field?

[richgalloway · Accepted solution]

The _indextime field shows when an event was ingested. It's a hidden field, though, so you'll have to assign its value to another field to view it. | eval indextime = _indextime | table _time indextime.

[traxxasbreaker]

There is a hidden field called _indextime that you can use for this.