Documentation > Splunk > Admin Manual > Tune Timestamping

Admin Manual

 


Getting Started
How Splunk Works
Configuring a Splunk Deployment
Data Inputs
Hosts
Source Types
Timestamp Recognition
Events
Event Types
Meta Events
Fields
Segmentation
Saved Searches and Alerts
Authentication
Granular Access Control
Data Distribution
Distributed Search
Deployment Server
Index Management
Bundles
SplunkBase
Performance Tuning
Routine Maintenance
How-To
Troubleshooting
Reference

Tune Timestamping

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Contents

Tune Timestamping

You can tune timestamping for better performance by editing props.conf


Turn off timestamp lookahead

If your data is being indexed in real time, and you want to use indexing time as the timestamp, you can increase Splunk's overall performance by turning off timestamp lookahead. Under this configuration, Splunk will no longer search through events or sources for time or date values. You can also turn off timestamps for a specific host, source or sourcetype, as well.


To turn off timestamp lookahead for a particular source, sourcetype or host, edit the stanza in $SPLUNK_HOME/etc/bundles/local/props.conf. 


[<spec>]
MAX_TIMESTAMP_LOOKAHEAD = 0

<spec> can be:

  1. <sourcetype>, the sourcetype of an event
  2. host::<host>, where <host> is the host for an event
  3. source::<source>, where <source> is the source for an event

You can also increase performance by setting MAX_TIMESTAMP_LOOKAHEAD lower (the default value is 150). You should do this if your timestamps occur in the first part of your event. The number following MAX_TIMESTAMP_LOOKAHEAD denotes the number of characters to search through for a timestamp.

Retrieved from "http://docs.splunk.com/Documentation/Splunk/3.1.4/Admin/TuneTimestamping"

This documentation applies to the following versions of Splunk: 3.0.1 , 3.0.2 , 3.1 , 3.1.1 , 3.1.2 , 3.1.3 , 3.1.4 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.