Splunk Search

include indexTime in output file

efelder0
Communicator

I am looking to include the indexTime in my output file and then append that that field to an existing 'CreateTimeStamp' field. What is the best method to extract indexTime (or recentTime)?

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Not sure what your "output file" is, but here goes:

The time an event was indexed is available in the field _indextime. You might have some problems with actually viewing it because it's by default a purely internal field that isn't shown to users. You can however make it visible by eval:ing it:

 ... | eval indextime=_indextime

After that you can just include the indextime field in whatever output you need.

View solution in original post

Ayn
Legend

Not sure what your "output file" is, but here goes:

The time an event was indexed is available in the field _indextime. You might have some problems with actually viewing it because it's by default a purely internal field that isn't shown to users. You can however make it visible by eval:ing it:

 ... | eval indextime=_indextime

After that you can just include the indextime field in whatever output you need.

mslvrstn
Communicator

Ayn, I combined this with your other answer
http://splunk-base.splunk.com/answer_link/41401/
about getting readable times, to get
| eval indextime=strftime(_indextime,"%+")

Thanks for both excellent answers!

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...