timestamp

noun

A default field that represents time information in an event. Most events contain timestamps, and in those cases where an event doesn't contain timestamp information, Splunk attempts to assign a timestamp value to the event at index time. Splunk uses timestamps to correlate events by time, to create the timeline histogram in Splunk Web, and to set time ranges for searches.

Timestamp assignment is highly configurable. Among other things, you can apply timezone offsets to timestamps.

For more information

In the User Manual:

• Use default fields

In the Getting Data In Manual:

• About default fields
• How timestamp assignment works

• Alphabetical
• By Topic