Splunk Search

How do I Filter by ingested timestamp?

New Member

Hi all, day1 splunker here.  I'd like to use an ingested start and stop time in index BLUE and use it to range-filter events in from index RED.   using the splunk event _time on the RED is ok.   Just a nudge in the right direction is what I'm after... thanks all

Labels (1)
Tags (2)
0 Karma

Ultra Champion

I know that some SIEM solutions can store several different timestamps per event (time the event was supposedly recorded at source, time it was received at first receiver, time it was sent "upstream", parsed and indexed and so on). Splunk on its own stores just a _time field (which depending on the configuration might be parsed from the event itself or generated as a "current" timestamp at the time the event was received) and _indextime which tells you when the event was parsed and stored in the index. There are no additional timestamps generated by Splunk (in some particularily strange configs you could probably generate additional timestamp at first Heavy Forwarder that sees the event but let's not dive into that).

So in general, all that is available to you (unless you have additional time-related fields within the event itself and you parse them out) is _time and _indextime. But the _indextime is not normally visible in the results so you have to do some eval/rename magic to get its value.

Having said that - you usually don't have to bother with _indextime unless you're troubleshooting indexing delay situations or something similar. You're usually most interested in the _time field.

0 Karma

Esteemed Legend

Hi @Bob2k,

if you could share some sample of your BLUE and REd index.

Anyway, if you want to use the time borders of the search on index=BLUE on the index=RED, youshould try something like this:

<your_search_on_index_RED> [ search <your_search_on_index_BLUE> | stats earliest(_time) AS earliest latest(_time) AS latest | fields earliest latest ]
| ...

please see the approach and adapt it to your need.



0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...