How to generate a search for new events based on index time not event timestamp?

[techols]

I want to build a system where an external event consumer periodically pulls newly indexed events from Splunk on a scheduled basis (e.g., every 15 or 30 minutes, or hourly). The concern I have is that the indexing of events by Splunk can be interrupted due to licensing issues or due to network or server issues where a forwarder is temporarily prevented from sending events. When the forwarding or indexing of events is restored, we will be indexing old events with timestamps set by the props.conf to the old times.

So in queries from the external system, I want it to be able to query for events indexed in the last X minutes independent of the event timestamp. This will allow me to pick up old events that were recently indexed without overly complex queries. Is this concept possible to implement in Spunk?

[woodcock]

There are the _index_earliest and _index_latest directives, like this:

index=* _index_earliest="-10m@m" _index_latest=now()

https://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/SearchTimeModifiers

[techols]

Thanks! Sounds like that would work.

[woodcock]

Be sure to click Accept when it does! 😆