Splunk Search

How can I see the Date/time my data was received by Splunk?

Explorer

I'm having an issue with NTP, so the date and time of the records sent by the Operating Systems are all wrong. I want to see/or sort my data within Splunk by the Date/Time the record was received by the Splunk daemon.

Is this possible?

0 Karma

SplunkTrust
SplunkTrust

Try using _indextime. It has to be assigned to a variable before it can be used in commands. Like this

your base search | eval sortTime=_indextime | sort sortTime | table ...
---
If this reply helps you, an upvote would be appreciated.
0 Karma

Community Manager
Community Manager

Hi @hartcl1

Are you looking for the internal _indextime field?
http://docs.splunk.com/Documentation/Splunk/6.3.3/Knowledge/UseDefaultFields#Internal_fields

0 Karma