Splunk Search

"Last 15 min" - refers to event time or index time ?


"Last 15 minutes" - Is this referring to index time (or) Events time ?

I have hosts located in different timezones, and my Search head & indexers running in GMT TZ.
So,when I do a search for say.,"Last 15 min" , this refers to GMT's timezones last 15 minute ?

I am referring to this since, i might miss data in my search result as host's event time are in their native TZ format which will not be shown for my search

0 Karma


Martin has answered your question.

Suppose if you need index time. Use _indextime field.

index= your_index earliest=-10m@m | dedup _indextime | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S") | table indextime

0 Karma


That refers to the event's time, namely the _time field.

All times in the UI are in the Splunk user's timezone, which defaults to the Search Head timezone.
For indexing other timezones where the event doesn't specify the timezone you can set the timezone for a host in props.conf like this:

TZ = timezone

See http://docs.splunk.com/Documentation/Splunk/6.1.3/Admin/propsconf for reference.

If you want to search for the last 15 minutes by index time you can search over all time using this:

_index_earliest=-15m _index_latest=now actual search goes here
Get Updates on the Splunk Community!

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...