Splunk Search

include indexTime in output file

efelder0
Communicator

I am looking to include the indexTime in my output file and then append that that field to an existing 'CreateTimeStamp' field. What is the best method to extract indexTime (or recentTime)?

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Not sure what your "output file" is, but here goes:

The time an event was indexed is available in the field _indextime. You might have some problems with actually viewing it because it's by default a purely internal field that isn't shown to users. You can however make it visible by eval:ing it:

 ... | eval indextime=_indextime

After that you can just include the indextime field in whatever output you need.

View solution in original post

Ayn
Legend

Not sure what your "output file" is, but here goes:

The time an event was indexed is available in the field _indextime. You might have some problems with actually viewing it because it's by default a purely internal field that isn't shown to users. You can however make it visible by eval:ing it:

 ... | eval indextime=_indextime

After that you can just include the indextime field in whatever output you need.

mslvrstn
Communicator

Ayn, I combined this with your other answer
http://splunk-base.splunk.com/answer_link/41401/
about getting readable times, to get
| eval indextime=strftime(_indextime,"%+")

Thanks for both excellent answers!

0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...