Documentation: 3.2
|  Print Version Contents
This page last updated: 04/17/08 12:04pm

How timestamp extraction works

Splunk uses timestamps to correlate events by time, create the histogram in Splunk Web and to set time ranges for searches. Timestamps are assigned to events at index time. Most events get a timestamp value assigned to them based on information in the raw event data. If an event doesn't contain timestamp information, Splunk attempts to assign a timestamp value to the event as it's indexed. Splunk stores timestamp values in the _time field (in UTC time format).

Precedence rules for timestamp assignment

Splunk uses the following precedence to assign timestamps to events:

1. Look for a time or date in the event itself (use positional timestamp extraction for events that have more than one timestamp value in the raw data).
2. If event doesn't have a time or date, use the timestamp from the most recent previous event of the same source.
3. If no events in a source have a time or date, look in the source (or file) name.
4. If no other timestamp is found, set the timestamp to the current system time (at the event's index time).

Configure timestamps

Most events don't require any special timestamp handling. For some sources and distributed deployments, you may have to configure timestamp formatting to extract timestamps from events. Configure Splunk's timestamp extraction processor by editing props.conf.

Configure Splunk's timestamp extraction processor to:

Previous: Dynamic metadata assignment    |    Next: Configure timestamp extraction in props.conf

Comments

  1. broken link fixed.
    Posted by emma on Apr 16 2008, 8:54am

  2. "bundle files" link is broken
    Posted by lital on Apr 16 2008, 8:45am

  3. Err, bad comment :) it links to a syntax example
    Posted by lital on Apr 16 2008, 8:45am

  4. How about a syntax example for props.conf?
    Posted by lital on Apr 16 2008, 8:44am

Log in to comment.