Splunk Search
Highlighted

How to display index time in table?

Builder

I'm having a hard time displaying the event index time in a table. What is the field name for index time?

Tags (1)
Highlighted

Re: How to display index time in table?

Splunk Employee
Splunk Employee

Something like '* | convert ctime(_indextime) as it | table host it'.

Highlighted

Re: How to display index time in table?

Builder

Isn't there just a field name to display the event or index time? I tried the above and it didn't work.

0 Karma
Highlighted

Re: How to display index time in table?

Splunk Employee
Splunk Employee

The field name is _indextime, as shown. he is formatting it for you using the convert command http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Convert since it is an epoch time and you might want it displayed differently. There is of course more than one way to reformat the timestamp.

0 Karma
Highlighted

Re: How to display index time in table?

Builder

Thank you.

0 Karma
Highlighted

Re: How to display index time in table?

SplunkTrust
SplunkTrust

Field names starting with an underscore usually will not show up in a results table. The easiest thing to do is use the eval command to make a new field that is viewable. Note it will be in epoch time (that is seconds-since 1/1/1970 00:00:00 UTC)

In addition to the technique shown by Jag above, you could try adding this to your search:

| eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")

which should make a new field called indextime with a ISO-formatted value.

View solution in original post

Highlighted

Re: How to display index time in table?

Builder

So I was able to display the time in a table by simply adding the filed " _time ". Works great and no eval or convert required!

0 Karma
Highlighted

Re: How to display index time in table?

Splunk Employee
Splunk Employee

that is not the index time. that is the event time.

Highlighted

Re: How to display index time in table?

Builder

Oh Ok, thanks for the clarification. Now thanks to the input I know how to display index time and the event time. Thanks again.