This information is available in the field _indextime
. To make it "visible" for whatever purpose you're using it for you might want to use eval
. For instance
... | eval indextime=_indextime | convert ctime(indextime) | table indextime
Are you asking how Splunk assigns a timestamp to events coming into Splunk?
See the documentation at http://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps
Splunk uses the following precedence rules to assign timestamps to events:
Splunk looks for a time or date in the event itself using an explicit TIME_FORMAT, if provided. You configure TIME_FORMAT in props.conf.
If no TIME_FORMAT was configured for the data, Splunk attempts to automatically identify a time or date in the event itself. It uses the event's source type (which includes TIME_FORMAT information) to try to find the timestamp.
If an event doesn't have a time or date, Splunk uses the timestamp from the most recent previous event of the same source.
If no events in a source have a date, Splunk tries to find one in the source name or file name. (This requires that the events have a time, even though they don't have a date.)
For file sources, if no time or date can be identified in the file name, Splunk uses the file's modification time.
As a last resort, Splunk sets the timestamp to the current system time when indexing each event.
Thanks and could there a method to show when did that event indexed in Splunk?
Hey rossikwan...can we get a little more information here. What is the data you are trying to put into splunk and let us know what it is displaying as date and time?
Regards Vince