I'm trying to create a timechart to show when logs were ingested. Trying to use _indextime but it doesn't seem to be working. What am I missing on my SPL?
Current query
index=web
| eval _time=strptime(_indextime, "%d-%b-%y %H:%M:%S")
| timechart span=1h count by index
You shouldn't be putting a formatted string timestamp into _time. Splunk expects an epoch timestamp there (even though it usually presents _time automatically as a human readable string). So just try eval _time = _indextime
.
_indextime
is already in epoch. No conversion is needed.
| eval _time = _indextime
Try strftime
instead
index=web
| eval indextime=strftime(_indextime, "%d-%b-%y %H:%M:%S")
| timechart span=1h max(indextime) by index
If you wanted to identify indexing lag, you can do this
index=web
| eval indextime=strftime(_indextime, "%s")
| eval diff=indextime-_time
| timechart span=1h max(diff) AS diff
You shouldn't be putting a formatted string timestamp into _time. Splunk expects an epoch timestamp there (even though it usually presents _time automatically as a human readable string). So just try eval _time = _indextime
.