Splunk Enterprise

Is the search range for real-time search "_time" or "indextime"?

skasagawa
Explorer

For example, a real-time search is being performed in the past 10 minutes window.

At this time, data with a timestamp of 15 minutes ago was imported.

When the search for _time, there are no hits because it does not correspond to the past 10 minutes, but when the search for indextime, there are hits.
I would like to know which is the basis of the search in real-time search.

 

Labels (2)
0 Karma
1 Solution

inventsekar
Ultra Champion

hi @skasagawa ... Pls run this search with real time.. 

index=yourindex
| eval indexTime = _indextime
| table _time, indexTime
| convert ctime(indexTime)

 the _indextime will be the timestamp at which the event was received at the indexer and the _time is the timestamp of the event.  (at times, the difference between _time and _indextime of few seconds can be accepted. if the difference is like 1 or 2 mins or more, then, you should do some troubleshooting of the host timestamp)

so most probably your events have some wrong time settings. pls let us know if you have questions.. thanks..

View solution in original post

0 Karma

inventsekar
Ultra Champion

hi @skasagawa ... Pls run this search with real time.. 

index=yourindex
| eval indexTime = _indextime
| table _time, indexTime
| convert ctime(indexTime)

 the _indextime will be the timestamp at which the event was received at the indexer and the _time is the timestamp of the event.  (at times, the difference between _time and _indextime of few seconds can be accepted. if the difference is like 1 or 2 mins or more, then, you should do some troubleshooting of the host timestamp)

so most probably your events have some wrong time settings. pls let us know if you have questions.. thanks..

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...