Events recevie date & time

[rossikwan]

After the events received, how to identify the events receiving date & time?

[Ayn]

This information is available in the field _indextime. To make it "visible" for whatever purpose you're using it for you might want to use eval. For instance

... | eval indextime=_indextime | convert ctime(indextime) | table indextime

[datasearchninja]

Are you asking how Splunk assigns a timestamp to events coming into Splunk?

See the documentation at http://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps

Splunk uses the following precedence rules to assign timestamps to events:

1. Splunk looks for a time or date in the event itself using an explicit TIME_FORMAT, if provided. You configure TIME_FORMAT in props.conf.

2. If no TIME_FORMAT was configured for the data, Splunk attempts to automatically identify a time or date in the event itself. It uses the event's source type (which includes TIME_FORMAT information) to try to find the timestamp.

3. If an event doesn't have a time or date, Splunk uses the timestamp from the most recent previous event of the same source.

4. If no events in a source have a date, Splunk tries to find one in the source name or file name. (This requires that the events have a time, even though they don't have a date.)

5. For file sources, if no time or date can be identified in the file name, Splunk uses the file's modification time.

6. As a last resort, Splunk sets the timestamp to the current system time when indexing each event.

[rossikwan]

Thanks and could there a method to show when did that event indexed in Splunk?

[vincesesto]

Hey rossikwan...can we get a little more information here. What is the data you are trying to put into splunk and let us know what it is displaying as date and time?
Regards Vince