How Splunk extracts timestamps
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
How Splunk extracts timestamps
Splunk uses timestamps to correlate events by time, create the histogram in Splunk Web and to set time ranges for searches. Timestamps are assigned to events at index time. Most events get a timestamp value assigned to them based on information in the raw event data. If an event doesn't contain timestamp information, Splunk attempts to assign a timestamp value to the event as it's indexed. Splunk stores timestamp values in the _time field (in UTC time format).
Precedence rules for timestamp assignment
Splunk uses the following precedence to assign timestamps to events:
1. Look for a time or date in the event itself using an explicit TIME_FORMAT if provided.
Use positional timestamp extraction for events that have more than one timestamp value in the raw data, or when the desired timestamp is not at the start of the line.
2. If no TIME_FORMAT is provided, or no match is found, attempt to automatically identify a time or date in the event itself.
Use positional timestamp extraction for events that have more than one timestamp value in the raw data.
3. If an event doesn't have a time or date, use the timestamp from the most recent previous event of the same source.
4. If no events in a source have a date, look in the source (or file) name (Must have time in the event).
5. For file sources, if no date can be identified in the file name, use the modification time on the file.
6. If no other timestamp is found, set the timestamp to the current system time (at the event's index time).
Configure timestamps
Most events don't require any special timestamp handling. For some sources and distributed deployments, you may have to configure timestamp formatting to extract timestamps from events. Configure Splunk's timestamp extraction processor by editing props.conf. For a complete discussion of the timestamp configurations available in props.conf, see this overview.
You can also configure Splunk's timestamp extraction processor to:
- Apply timezone offsets.
- Recognize European date format.
- Pull the correct timestamp from events with more than one timestamp.
- Improve indexing performance.
Finally, train Splunk to recognize new timestamp formats.
This documentation applies to the following versions of Splunk: 3.3 , 3.3.1 , 3.3.2 , 3.3.3 , 3.3.4 , 3.4 , 3.4.1 , 3.4.2 , 3.4.3 , 3.4.5 , 3.4.6 , 3.4.8 , 3.4.9 , 3.4.10 , 3.4.11 , 3.4.12 , 3.4.13 , 3.4.14 View the Article History for its revisions.