Getting Data In

Event received time vs parsed event time

alexander_lucas
Explorer

Dears,

Are there separate fields for:

Event received time (when event was received by Splunk); and

Parsed (extracted) event time?

My understanding is that for any events that have a recognisable timestamp Splunk will try to extract it at index time and store in the _time internal field (as epoch time).

Then at search time Spunk dynamically creates date_* fields. What I would like to know if there is another field that contains event received time (regardless of the event content, extractions etc) ?

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

There is a field _indextime on each event that indicates when an event was indexed.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

There is a field _indextime on each event that indicates when an event was indexed.

alexander_lucas
Explorer

thank you gk and araitz

0 Karma

araitz
Splunk Employee
Splunk Employee

To make it viewable, add to your search: | eval indextime=_indextime

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...