Handle event timestamps
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Handle event timestamps
Look carefully at this sample event:
172.26.34.223 - - [01/Jul/2005:12:05:27 -0700] "GET /trade/app?action=logout HTTP/1.1" 200 2953
Notice the time information in the event: [01/Jul/2005:12:05:27 -0700]. This is what is known as a timestamp. Splunk uses timestamps to correlate events by time, create the histogram in Splunk Web, and set time ranges for searches. Most events contain timestamps, and in those cases where an event doesn't contain timestamp information, Splunk attempts to assign a timestamp value to the event at index time.
Most events do not require additional handling of timestamp formatting, but there are situations that require the involvement of a Splunk administrator to help set things right. In the case of some sources and distributed deployments, for example, the Splunk admin may have to reconfigure timestamp recognition and formatting. Other timestamp-handling activities that the admin might undertake include:
- Configuration of timestamp extraction for events with multiple timestamps
- Application of timestamp offsets (to correlate events from different timezones)
- Training Splunk to recognize a timestamp
- Tuning timestamp extraction performance
For more information about timestamps, see the Configure event timestamping chapter of this manual.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 View the Article History for its revisions.