Community:Search by time of indexing
From Splunk Wiki
Search for events by the (epoch) time they were indexed:
foo _indextime=12560* | rename _indextime as indexedtime
Or the more friendly:
foo | rename _indextime as indexedtime | convert ctime(indexedtime) as humanindexedtime