Splunk Search

Search earliest"-10m" based on a datetime field from the event and not from the indexed time



i want to search the events from the last 10 minutes based on the secondary datetime field from a event.

Normal Search with Index time:
earliest="-10m" index="xxx" source="xxx"

Spezial Search with Event time:
earliest(from DateTime Field)="-10m" index="xxx" source="xxx" ???

Thank You

Tags (1)
0 Karma


Hey criedman,

You can try something like this:
index="xxx" source="xxx" |eval currenttime=now() |eval a=currenttime-36000 |search datetimefield >a

In this case,you will be comparing the currenttime-10mins which gives a in epoch of 10 mins earlier.Also please make sure you convert the datetimefield in epoch as well.

Let me know if this works!!

0 Karma


What you should do is set your timestamp recognition up properly so that the time Splunk is registering is the one from your event contents, not when the event was indexes. Splunk has two different fields for time: _indextime which is always when the event was indexed, and _time which is the time registered for the event. Typically this is retrieved by parsing a timpestamp from the event data. See more information available in the docs here: https://docs.splunk.com/Documentation/Splunk/7.1.1/Data/Configuretimestamprecognition

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...