Splunk Search

How to create a timechart based on index time?

DEAD_BEEF
Builder

I'm trying to create a timechart to show when logs were ingested. Trying to use _indextime but it doesn't seem to be working. What am I missing on my SPL?

Current query

index=web
| eval _time=strptime(_indextime, "%d-%b-%y %H:%M:%S") 
| timechart span=1h count by index
0 Karma
1 Solution

FrankVl
Ultra Champion

You shouldn't be putting a formatted string timestamp into _time. Splunk expects an epoch timestamp there (even though it usually presents _time automatically as a human readable string). So just try eval _time = _indextime.

View solution in original post

DalJeanis
Legend

_indextime is already in epoch. No conversion is needed.

 | eval  _time = _indextime  

skoelpin
SplunkTrust
SplunkTrust

Try strftime instead

index=web
 | eval indextime=strftime(_indextime, "%d-%b-%y %H:%M:%S") 
 | timechart span=1h max(indextime) by index

If you wanted to identify indexing lag, you can do this

    index=web
   | eval indextime=strftime(_indextime, "%s") 
   | eval diff=indextime-_time
   | timechart span=1h max(diff) AS diff
0 Karma

FrankVl
Ultra Champion

You shouldn't be putting a formatted string timestamp into _time. Splunk expects an epoch timestamp there (even though it usually presents _time automatically as a human readable string). So just try eval _time = _indextime.

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...