Timestamps and time ranges

Most events contain a timestamp. If events don't contain timestamp information, Splunk software assigns a timestamp value to the events when data is indexed.

Timestamps are used to:

• Correlate events by time
• Create timeline histograms
• Set time ranges for searches

Timestamps are stored in UNIX time

Regardless of how time is specified in your events, timestamps are converted to UNIX time and stored in the _time field when your data is indexed. If your data does not have timestamps, the time at which your data is indexed is used as the timestamp for your events.

UNIX time is the number of seconds that have elapsed since 00:00:00 Coordinated Universal Time (UTC), 1 January 1970. This moment in time is sometimes referred to as epoch time. UNIX time appears as a series of numbers, for example 1518632124. You can use any UNIX time converter to convert the UNIX time to either GMT or your local time.

GMT and UTC

GMT (Greenwich Mean Time) is sometimes confused with UTC (Coordinated Universal Time). However GMT is a time zone and UTC is a time standard.

• GMT is a time zone officially used in some European and African countries as their local time. The time is displayed in either the 24-hour format (00:00-23:59) or the 12-hour format (00:00-12:00 AM/PM).
• UTC is a time standard that is the basis for time and time zones worldwide. No country uses UTC as a local time.
• Neither GMT nor UTC ever change for Daylight Saving Time (DST). However, some of the countries that use GMT switch to different time zones during their DST period. For example, the United Kingdom uses GMT for most of the year, but switches to British Summer Time (BST) during the summer months. BST is one hour ahead of GMT.

The _time field

The _time field appears in a human readable format in Splunk user interfaces. However, the values in the _time field are stored in UNIX time.

Specify narrow time ranges

Splunk user interfaces use a default time range when you create a search. This range helps to avoid running searches with overly-broad time ranges that waste system resources and produce more results than you really need.

Whether you are running a new search, a report, or creating a dashboard, it is important to narrow the time range to only the dates or times that you really need.

Time is also crucial for determining what went wrong. You often know when something happened, if not exactly what happened. By looking at events that happened around the same time that something went wrong, can help correlate results and find the root cause of the problem.

Time ranges and subsearches

Time ranges selected from the Splunk UI Time Range Picker apply to the base search and to subsearches.

However, time ranges specified directly in the base search do not apply to subsearches. Likewise, a time range specified directly in a subsearch applies only to that subsearch. The time range does not apply to the base search or any other subsearch.

For example, if the Time Range Picker is set to Last 7 days and a subsearch contains earliest=2d@d, then the earliest time modifier applies only to the subsearch and Last 7 days applies to the base search.

See also

Related information

Time modifiers

Specifying relative time

Specifying time spans

Using time variables

Time zones