Splunk® Enterprise

Getting Data In

Download manual as PDF

Splunk Enterprise version 5.0 reached its End of Life on December 1, 2017. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Tune timestamp recognition for better indexing performance

To speed up indexing, you can adjust how far ahead into events Splunk's timestamp processor looks, or even turn off the timestamp processor altogether. You do this by editing props.conf.

For general information on editing props.conf for timestamps, see "Configure timestamp recognition".

Adjust timestamp lookahead

Timestamp lookahead determines how far (how many characters) into an event the timestamp processor looks for a timestamp. Adjust how far the timestamp processor looks by setting the MAX_TIMESTAMP_LOOKAHEAD attribute.

The default number of characters that the timestamp processor looks into an event is 128. You can set MAX_TIMESTAMP_LOOKAHEAD to a lower value to speed up indexing. You should particularly do this if the timestamps always occur in the first part of the event.

Example:

This example tells Splunk to look for timetamps in just the first 20 characters of events coming from source foo.

[source::foo]
MAX_TIMESTAMP_LOOKAHEAD = 20
...

Disable timestamp processor

You can turn off the timestamp processor entirely to improve indexing performance. Turn off timestamp processing for events matching a specified host, source, or sourcetype by setting the DATETIME_CONFIG attribute to NONE. When DATETIME_CONFIG=NONE, Splunk does not look at the text of the event for the timestamp. Instead, it uses the event's "time of receipt"; in other words, the time the event is received via its input. For file-based inputs (such as monitor) this means that Splunk derives the timestamp from the modification time of the input file.

You can also increase Splunk's indexing performance by setting DATETIME_CONFIG to CURRENT. This causes Splunk to assign the current system time to each event at the time of indexing.

Example:

This example turns off timestamp extraction for events that come from the source foo.

[source::foo]
DATETIME_CONFIG = NONE
...

Note: Both CURRENT and NONE explicitly disable timestamp identification, so the default event boundary detection (BREAK_ONLY_BEFORE_DATE = true) is likely not to work as desired. When using these settings, use SHOULD_LINEMERGE and/or the BREAK_ONLY_* , MUST_BREAK_* settings to control event merging.

PREVIOUS
Specify time zones of timestamps
  NEXT
About indexed field extraction

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters