Load Time vs Event Time

[fredclown]

I know that I ca get the event time using "_time". Does Splunk keep track of the time the event was loaded into Splunk in a field? We have some duplicate data that was loaded for a day, but it was loaded on a different day than the original day. So, if I were able to do a search like below I could easily find the duplicate values and remove them.

index="epicdata" earliest="07/03/2013:00:00:00" latest="07/04/2013:00:00:00" load_time>="07/04/2013:00:00:00" | delete

Update:

Here is what I did ... worked great! Basically, I got all of the events for 7/3 that were indexed on 7/6 and up and deleted them.

index = "myindex" _time >= "1372834800" _time < "1372921200" _indextime >= "1373094000" | delete

1372834800 epoch for 7/3/2013
1372921200 epoch for 7/4/2013
1373094000 epoch for 7/6/2013

[Ayn · Accepted solution]

Yes, there is such a field. It's called _indextime and carries the time when an event was indexed, in epoch format.

[mendesjo]

I added _indextime to a multiple indexes shows nothing.. how do you get the epoch time to show up?

[fredclown]

Oh good. That makes it easier. Thanks for your help.

[Ayn]

Awesome! It's local.

[fredclown]

Is the epoch time in UTC/GMT or local?

[fredclown]

Bless you. This will make it a cinch to remove the duplicate data.