Splunk Search

Load Time vs Event Time

fredclown
Contributor

I know that I ca get the event time using "_time". Does Splunk keep track of the time the event was loaded into Splunk in a field? We have some duplicate data that was loaded for a day, but it was loaded on a different day than the original day. So, if I were able to do a search like below I could easily find the duplicate values and remove them.

index="epicdata" earliest="07/03/2013:00:00:00" latest="07/04/2013:00:00:00" load_time>="07/04/2013:00:00:00" | delete

Update:

Here is what I did ... worked great! Basically, I got all of the events for 7/3 that were indexed on 7/6 and up and deleted them.

index = "myindex" _time >= "1372834800" _time < "1372921200" _indextime >= "1373094000" | delete

1372834800 epoch for 7/3/2013
1372921200 epoch for 7/4/2013
1373094000 epoch for 7/6/2013
Tags (3)
1 Solution

Ayn
Legend

Yes, there is such a field. It's called _indextime and carries the time when an event was indexed, in epoch format.

View solution in original post

Ayn
Legend

Yes, there is such a field. It's called _indextime and carries the time when an event was indexed, in epoch format.

mendesjo
Path Finder

I added _indextime to a multiple indexes shows nothing.. how do you get the epoch time to show up?

0 Karma

fredclown
Contributor

Oh good. That makes it easier. Thanks for your help.

0 Karma

Ayn
Legend

Awesome! It's local.

0 Karma

fredclown
Contributor

Is the epoch time in UTC/GMT or local?

0 Karma

fredclown
Contributor

Bless you. This will make it a cinch to remove the duplicate data.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...