How Splunk recognizes timestamps

How Splunk recognizes timestamps

Accurate timestamps are crucial for correlating events by time, using Splunk's histogram and setting time ranges for searches. Splunk will make a best effort to assign an accurate timestamp. However, if Splunk cannot find a timestamp within a given source or event, the timestamp will be set to the current time (at indexing).

Timestamp precedence

When timestamping, Splunk sets a local variable for both the date and time. These variables are updated continuously throughout the indexing process, via the following steps:

1. Splunk looks for a time or date in the event itself.

1. If an event does not have a time or date, Splunk uses the timestamp from the previous event in the same source.

1. If no events in a source have a time or date, Splunk will look in the source (or file) name.

1. Splunk will use indexing time and date if no other timestamp is found.

If you would like to configure Splunk to set timestamps in a different manner, please read change how Splunk recognizes timestamps. You can also train Splunk to recognize timestamps or tune timestamping to increase Splunk's performance.

Configuration files for timestamps

• Timestamp format and recognition can be configured via props.conf.
• Before manually modifying any configuration file, please read about bundle files.