Splunk Search

How do I Filter by ingested timestamp?

Bob2k
New Member

Hi all, day1 splunker here.  I'd like to use an ingested start and stop time in index BLUE and use it to range-filter events in from index RED.   using the splunk event _time on the RED is ok.   Just a nudge in the right direction is what I'm after... thanks all

Labels (1)
Tags (2)
0 Karma

PickleRick
Ultra Champion

I know that some SIEM solutions can store several different timestamps per event (time the event was supposedly recorded at source, time it was received at first receiver, time it was sent "upstream", parsed and indexed and so on). Splunk on its own stores just a _time field (which depending on the configuration might be parsed from the event itself or generated as a "current" timestamp at the time the event was received) and _indextime which tells you when the event was parsed and stored in the index. There are no additional timestamps generated by Splunk (in some particularily strange configs you could probably generate additional timestamp at first Heavy Forwarder that sees the event but let's not dive into that).

So in general, all that is available to you (unless you have additional time-related fields within the event itself and you parse them out) is _time and _indextime. But the _indextime is not normally visible in the results so you have to do some eval/rename magic to get its value.

Having said that - you usually don't have to bother with _indextime unless you're troubleshooting indexing delay situations or something similar. You're usually most interested in the _time field.

0 Karma

gcusello
Legend

Hi @Bob2k,

if you could share some sample of your BLUE and REd index.

Anyway, if you want to use the time borders of the search on index=BLUE on the index=RED, youshould try something like this:

<your_search_on_index_RED> [ search <your_search_on_index_BLUE> | stats earliest(_time) AS earliest latest(_time) AS latest | fields earliest latest ]
| ...

please see the approach and adapt it to your need.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...