Splunk Search

How do I Filter by ingested timestamp?

Bob2k
New Member

Hi all, day1 splunker here.  I'd like to use an ingested start and stop time in index BLUE and use it to range-filter events in from index RED.   using the splunk event _time on the RED is ok.   Just a nudge in the right direction is what I'm after... thanks all

Labels (1)
Tags (2)
0 Karma

PickleRick
Ultra Champion

I know that some SIEM solutions can store several different timestamps per event (time the event was supposedly recorded at source, time it was received at first receiver, time it was sent "upstream", parsed and indexed and so on). Splunk on its own stores just a _time field (which depending on the configuration might be parsed from the event itself or generated as a "current" timestamp at the time the event was received) and _indextime which tells you when the event was parsed and stored in the index. There are no additional timestamps generated by Splunk (in some particularily strange configs you could probably generate additional timestamp at first Heavy Forwarder that sees the event but let's not dive into that).

So in general, all that is available to you (unless you have additional time-related fields within the event itself and you parse them out) is _time and _indextime. But the _indextime is not normally visible in the results so you have to do some eval/rename magic to get its value.

Having said that - you usually don't have to bother with _indextime unless you're troubleshooting indexing delay situations or something similar. You're usually most interested in the _time field.

0 Karma

gcusello
Legend

Hi @Bob2k,

if you could share some sample of your BLUE and REd index.

Anyway, if you want to use the time borders of the search on index=BLUE on the index=RED, youshould try something like this:

<your_search_on_index_RED> [ search <your_search_on_index_BLUE> | stats earliest(_time) AS earliest latest(_time) AS latest | fields earliest latest ]
| ...

please see the approach and adapt it to your need.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...