The vast majority of time when searching your data, you want to search by the time parsed in the event. This is the norm. This is what Splunk is optimized for.
Sometimes, however, it would be nice to search by the time that the event arrived. This value is stored in an internal field called _indextime. It is not convenient to query this field, because it is simply stored as a string representing the epoch time value. Searching for _indextime>12345678 actually requires a complete index scan for the time period specified, which is needless to say inefficient.
This application provides a command and a macro that allows you to search reasonably efficiently against the _indextime field by building a subsearch that affects the main query, then filters against the specific values.
The macro must be the last item in the original query to function properly!
1. Alerting on events when they arrive in Splunk, regardless of when they happened.
For instance, you have a specific event that would be logged if the network is down, but that event would not make it to Splunk while the network is down. This can also be accomplished using real time alerting, and that may be a better solution in most cases.
2. Summary indexing of data that does not arrive in a consistent timeframe.
Most of the time, summary indexing is configured to run against data older than any expected latency. For instance, if it is possible that data will arrive within 2 minutes, then summary indexing might be configured to query data that has a date no newer than 5 minutes. But what if your data might arrive between one hour and three days? You could set the summary query to wait 3 days, but it certainly would be nice to be able to build summary entries for the data that arrives sooner.
For example 1, you would write a query such as:
index=network pingtest failure `indextimesearch("-2m@m","-1m@m")`
You would run such a query every minute, but over a long timeframe, say 6 hours.
The actual query that would be run would be something like this:
`` index=network pingtest failure
(_indextime=1320618110 OR _indextime=1320618100 OR _indextime=1320618090 OR _indextime=1320618080 OR _indextime=1320618070 OR _indextime=1320618060)
| eval et=relative_time(now(),"-2m@m")
| eval lt=relative_time(now(),"-1m@m")
| where _indextime>=et
| where _indextime
Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 50GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.