Splunk Enterprise

Is the search range for real-time search "_time" or "indextime"?

skasagawa
Explorer

For example, a real-time search is being performed in the past 10 minutes window.

At this time, data with a timestamp of 15 minutes ago was imported.

When the search for _time, there are no hits because it does not correspond to the past 10 minutes, but when the search for indextime, there are hits.
I would like to know which is the basis of the search in real-time search.

 

Labels (2)
0 Karma
1 Solution

inventsekar
Ultra Champion

hi @skasagawa ... Pls run this search with real time.. 

index=yourindex
| eval indexTime = _indextime
| table _time, indexTime
| convert ctime(indexTime)

 the _indextime will be the timestamp at which the event was received at the indexer and the _time is the timestamp of the event.  (at times, the difference between _time and _indextime of few seconds can be accepted. if the difference is like 1 or 2 mins or more, then, you should do some troubleshooting of the host timestamp)

so most probably your events have some wrong time settings. pls let us know if you have questions.. thanks..

View solution in original post

0 Karma

inventsekar
Ultra Champion

hi @skasagawa ... Pls run this search with real time.. 

index=yourindex
| eval indexTime = _indextime
| table _time, indexTime
| convert ctime(indexTime)

 the _indextime will be the timestamp at which the event was received at the indexer and the _time is the timestamp of the event.  (at times, the difference between _time and _indextime of few seconds can be accepted. if the difference is like 1 or 2 mins or more, then, you should do some troubleshooting of the host timestamp)

so most probably your events have some wrong time settings. pls let us know if you have questions.. thanks..

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...