# Splunk equivalent for \_index\_earliest and \_index\_latest **URL:** \ **Category:** Kibana\ **Created:** [October 10, 2016, 8:14am UTC](https://discuss.elastic.co/t/splunk-equivalent-for--index-earliest-and--index-latest/62614 "2016-10-10T08:14:45Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![shahzad](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@shahzad](https://discuss.elastic.co/u/shahzad)\ **Post date:** [October 10, 2016, 8:14am UTC](https://discuss.elastic.co/t/splunk-equivalent-for--index-earliest-and--index-latest/62614/1 "2016-10-10T08:14:45Z")
I am currently running a test VM to see if we can migrate from Splunk to ELK stack. I've got the data in the elasticsearch and I can see that data in Kibana. Now my next challenge is to run few searches which we run in [Splunk.In](http://Splunk.In) one of the search we search for all the logs splunk has indexed in last 5 minutes or whatever time you specify. I need to know how can I do this in Kibana? I've looked at the documentation but couldn't find anything. Thanks ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 10, 2016, 9:10am UTC](https://discuss.elastic.co/t/splunk-equivalent-for--index-earliest-and--index-latest/62614/2 "2016-10-10T09:10:37Z")
Have a look at [https://www.elastic.co/guide/en/kibana/current/discover.html#set-time-filter](https://www.elastic.co/guide/en/kibana/current/discover.html#set-time-filter) ---
**Author:** ![shahzad](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@shahzad](https://discuss.elastic.co/u/shahzad)\ **Post date:** [October 10, 2016, 1:11pm UTC](https://discuss.elastic.co/t/splunk-equivalent-for--index-earliest-and--index-latest/62614/3 "2016-10-10T13:11:32Z")
Mark thanks for providing the link. I'm afraid it doesn't answer my question. The set time filter applies to the time stamps of the events. Whereas I want to search against the time the events were indexed. For example Elasticsearch is indexing logs from yesterday right now. So I want to search for the data that was indexed in last 5 minutes and that should give me these events even though their time stamps are from yesterday. I hope my question make sense? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 10, 2016, 11:13pm UTC](https://discuss.elastic.co/t/splunk-equivalent-for--index-earliest-and--index-latest/62614/4 "2016-10-10T23:13:29Z")
Oh right, well you need to have specified a timestamp field with that time so you can filter on it. ---
**Author:** ![shahzad](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@shahzad](https://discuss.elastic.co/u/shahzad)\ **Post date:** [October 17, 2016, 10:50am UTC](https://discuss.elastic.co/t/splunk-equivalent-for--index-earliest-and--index-latest/62614/5 "2016-10-17T10:50:27Z")
Thanks for replying back Mark. I believe I haven't configured my indexing properly. My @timestamps are different than the date in the events which have been indexed. @timestamp is displaying the time these events were indexed. I've added the date filter to match the time from the events, restarted logstash but that didn't work. ``` filter { date { match => ["date","YYYY-MM-dd HH:mm:ss"] } csv { columns => ["date","field2","field3","field4"] separator => "," } ``` } ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [October 17, 2016, 1:43pm UTC](https://discuss.elastic.co/t/splunk-equivalent-for--index-earliest-and--index-latest/62614/6 "2016-10-17T13:43:35Z")
It looks like you are trying to apply the date filter to a field that you have not yet extracted. Try putting the csv filter before the data filter. ---
**Author:** ![shahzad](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@shahzad](https://discuss.elastic.co/u/shahzad)\ **Post date:** [October 18, 2016, 10:22am UTC](https://discuss.elastic.co/t/splunk-equivalent-for--index-earliest-and--index-latest/62614/7 "2016-10-18T10:22:44Z")
Hi Christian, that has fixed the problem. I can see in the logstash.log that its reading the date but its complaining about the formatting so I hope you'll be able to help once again. ``` {:timestamp=>"2016-10-18T10:43:38.739000+0100", :message=>"Failed parsing date from field", :field=>"date", :value=>"2016-10-03 08:48:11.0", :exception=>"Invalid format: \"2016-10-03 08:48:11.0\" is malformed at \".0\"", :config_parsers=>"YYYY-MM-dd HH:mm:ss", :config_locale=>"default=en_US", :level=>:warn} ``` This is what I've as my match stanza `match => ["date","YYYY-MM-dd HH:mm:ss"]` Logs are in this time format: `2016-10-03 23:41:39.0` ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [October 18, 2016, 10:29am UTC](https://discuss.elastic.co/t/splunk-equivalent-for--index-earliest-and--index-latest/62614/8 "2016-10-18T10:29:33Z")
As the error message indicates, there is a `.0` at the end that does not match your date pattern. You may want to clean the data up before applying the date filter. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:36pm UTC](https://discuss.elastic.co/t/splunk-equivalent-for--index-earliest-and--index-latest/62614/9 "2017-07-06T13:36:22Z")