icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading indextime search
SHA256 checksum (indextime-search_10.tgz) 90f900d92f6684aac66040cf843b23f2841f2eb18fdadd81bbf6cab93b05723e
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

indextime search

Overview
Details
Provides a macro and command to search reasonable efficiently for events based on their index time.

The vast majority of time when searching your data, you want to search by the time parsed in the event. This is the norm. This is what Splunk is optimized for.

Sometimes, however, it would be nice to search by the time that the event arrived. This value is stored in an internal field called _indextime. It is not convenient to query this field, because it is simply stored as a string representing the epoch time value. Searching for _indextime>12345678 actually requires a complete index scan for the time period specified, which is needless to say inefficient.

This application provides a command and a macro that allows you to search reasonably efficiently against the _indextime field by building a subsearch that affects the main query, then filters against the specific values.

NOTE:
The macro must be the last item in the original query to function properly!

Use cases...
1. Alerting on events when they arrive in Splunk, regardless of when they happened.
For instance, you have a specific event that would be logged if the network is down, but that event would not make it to Splunk while the network is down. This can also be accomplished using real time alerting, and that may be a better solution in most cases.

2. Summary indexing of data that does not arrive in a consistent timeframe.
Most of the time, summary indexing is configured to run against data older than any expected latency. For instance, if it is possible that data will arrive within 2 minutes, then summary indexing might be configured to query data that has a date no newer than 5 minutes. But what if your data might arrive between one hour and three days? You could set the summary query to wait 3 days, but it certainly would be nice to be able to build summary entries for the data that arrives sooner.

Usage:
For example 1, you would write a query such as:
index=network pingtest failure `indextimesearch("-2m@m","-1m@m")`
You would run such a query every minute, but over a long timeframe, say 6 hours.

The actual query that would be run would be something like this:
`` index=network pingtest failure
(_indextime=1320618110 OR _indextime=1320618100 OR _indextime=1320618090 OR _indextime=1320618080 OR _indextime=1320618070 OR _indextime=1320618060)
| eval et=relative_time(now(),"-2m@m")
| eval lt=relative_time(now(),"-1m@m")
| where _indextime>=et
| where _indextime

Release Notes

Version 1.0
Nov. 7, 2011

1
Install
248
Downloads
Share Subscribe LOGIN TO DOWNLOAD

Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 50GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2019 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.