Getting Data In

Filter by Index Time

motobeats
Path Finder

I added Apache logs from 2 webservers to Splunk in two batches a week apart. Dropped the files in a folder that I have Splunk watching so it doesn't know where they really came from. File names are all the same (should have changed them but didn't).

How do I filter logs from web-1 only? I was thinking that I could filter on indexed time but can't find a field for that value. Any ideas?

Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

You can add indexed time to your search result by something like this

index=yourindex sourcetype=your sourcetype | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

You can add indexed time to your search result by something like this

index=yourindex sourcetype=your sourcetype | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")

motobeats
Path Finder

Thanks to both. Good info. Didn't know _indextime was a field. Added this to my search did it
_indextime<1396310400

0 Karma

Ayn
Legend

If you want to filter on index time just like you would with timestamp, use the _index_earliest and _index_latest terms.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...