Splunk Search

Load Time vs Event Time

fredclown
Builder

I know that I ca get the event time using "_time". Does Splunk keep track of the time the event was loaded into Splunk in a field? We have some duplicate data that was loaded for a day, but it was loaded on a different day than the original day. So, if I were able to do a search like below I could easily find the duplicate values and remove them.

index="epicdata" earliest="07/03/2013:00:00:00" latest="07/04/2013:00:00:00" load_time>="07/04/2013:00:00:00" | delete

Update:

Here is what I did ... worked great! Basically, I got all of the events for 7/3 that were indexed on 7/6 and up and deleted them.

index = "myindex" _time >= "1372834800" _time < "1372921200" _indextime >= "1373094000" | delete

1372834800 epoch for 7/3/2013
1372921200 epoch for 7/4/2013
1373094000 epoch for 7/6/2013
Tags (3)
1 Solution

Ayn
Legend

Yes, there is such a field. It's called _indextime and carries the time when an event was indexed, in epoch format.

View solution in original post

Ayn
Legend

Yes, there is such a field. It's called _indextime and carries the time when an event was indexed, in epoch format.

mendesjo
Path Finder

I added _indextime to a multiple indexes shows nothing.. how do you get the epoch time to show up?

0 Karma

fredclown
Builder

Oh good. That makes it easier. Thanks for your help.

0 Karma

Ayn
Legend

Awesome! It's local.

0 Karma

fredclown
Builder

Is the epoch time in UTC/GMT or local?

0 Karma

fredclown
Builder

Bless you. This will make it a cinch to remove the duplicate data.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...