Splunk Search

How to generate a search for new events based on index time not event timestamp?

techols
New Member

I want to build a system where an external event consumer periodically pulls newly indexed events from Splunk on a scheduled basis (e.g., every 15 or 30 minutes, or hourly). The concern I have is that the indexing of events by Splunk can be interrupted due to licensing issues or due to network or server issues where a forwarder is temporarily prevented from sending events. When the forwarding or indexing of events is restored, we will be indexing old events with timestamps set by the props.conf to the old times.

So in queries from the external system, I want it to be able to query for events indexed in the last X minutes independent of the event timestamp. This will allow me to pick up old events that were recently indexed without overly complex queries. Is this concept possible to implement in Spunk?

0 Karma

woodcock
Esteemed Legend

There are the _index_earliest and _index_latest directives, like this:

index=* _index_earliest="-10m@m" _index_latest=now()

https://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/SearchTimeModifiers

techols
New Member

Thanks! Sounds like that would work.

0 Karma

woodcock
Esteemed Legend

Be sure to click Accept when it does! 😆

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...