How do I Filter by ingested timestamp?

[Bob2k]

Hi all, day1 splunker here.  I'd like to use an ingested start and stop time in index BLUE and use it to range-filter events in from index RED.   using the splunk event _time on the RED is ok.   Just a nudge in the right direction is what I'm after... thanks all

[PickleRick]

I know that some SIEM solutions can store several different timestamps per event (time the event was supposedly recorded at source, time it was received at first receiver, time it was sent "upstream", parsed and indexed and so on). Splunk on its own stores just a _time field (which depending on the configuration might be parsed from the event itself or generated as a "current" timestamp at the time the event was received) and _indextime which tells you when the event was parsed and stored in the index. There are no additional timestamps generated by Splunk (in some particularily strange configs you could probably generate additional timestamp at first Heavy Forwarder that sees the event but let's not dive into that).

So in general, all that is available to you (unless you have additional time-related fields within the event itself and you parse them out) is _time and _indextime. But the _indextime is not normally visible in the results so you have to do some eval/rename magic to get its value.

Having said that - you usually don't have to bother with _indextime unless you're troubleshooting indexing delay situations or something similar. You're usually most interested in the _time field.

[gcusello]

Hi @Bob2k,

if you could share some sample of your BLUE and REd index.

Anyway, if you want to use the time borders of the search on index=BLUE on the index=RED, youshould try something like this:

<your_search_on_index_RED> [ search <your_search_on_index_BLUE> | stats earliest(_time) AS earliest latest(_time) AS latest | fields earliest latest ]
| ...

please see the approach and adapt it to your need.

Ciao.

Giuseppe