Splunk® Enterprise

Getting Data In

Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

How timestamp assignment works

Timestamps are very important to Splunk Enterprise. The software uses timestamps to:

  • Correlate events by time.
  • Create the timeline histogram in Splunk Web.
  • Set time ranges for searches.

Splunk Enterprise assigns timestamps to events at index time. It usually assigns timestamp values automatically, using information in the raw event data. If an event doesn't contain an explicit timestamp, Splunk Enterprise attempts to assign a timestamp value through other means. For some data, it might need your help to tell it how to recognize the timestamps.

Splunk Enterprise stores timestamp values in the _time field (in UTC time format).

Timestamp processing is one of the key steps in event processing. For more information on event processing, see the chapter in this manual called "Configure event processing".

How Splunk Enterprise assigns timestamps

Splunk Enterprise uses the following precedence rules to assign timestamps to events:

1. It looks for a time or date in the event itself using an explicit TIME_FORMAT, if provided. You configure the TIME_FORMAT attribute in props.conf.

2. If no TIME_FORMAT was configured for the data, Splunk Enterprise attempts to automatically identify a time or date in the event itself. It uses the source type of the event (which includes TIME_FORMAT information) to try to find the timestamp.

3. If an event does not have a time or date, Splunk Enterprise uses the timestamp from the most recent previous event of the same source.

4. For file sources, if no date can be identified in the file name, Splunk Enterprise uses the file's modification time.

5. As a last resort, Splunk Enterprise sets the timestamp to the current system time when indexing each event.

Note: Splunk Enterprise can only extract dates from a source, not times. If you need to extract a time from a source, use a transform.

Configure timestamps

Most events don't require any special timestamp handling. Splunk Enterprise automatically recognizes and extracts their timestamps. However, for some sources and distributed deployments, you might need to configure how Splunk Enterprise extracts timestamps, so that they format properly.

There are two ways to configure timestamp extraction:

  • Use the "Set Sourcetype" page in Splunk Web to interactively adjust timestamps on sample data. Once you are happy with the results, save the changes to a new source type and then apply that source type to your data inputs. See "The "Set Sourcetypes" page."

You can also configure Splunk's timestamp extraction processor to:

Considerations when adding data from new inputs

If you index some data from a new input and then discover that you need to adjust the timestamp extraction process, you must reindex that data once you've made the configuration changes. Consider previewing your data to prevent the need to reindex.

Alternatively, you can test new data inputs in a test instance of Splunk Enterprise (or in a separate index on the production Splunk instance) before adding data to your production instance. That way, you can delete and reindex until you get the results you want.

Last modified on 23 October, 2017
Anonymize data
Configure timestamp recognition

This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters