About searching with time
You can use time to narrow your search and to group events in your search by time.
How timestamps are used
- Correlate events by time
- Create the timeline histogram in Splunk Web
- Set time ranges for searches
Timestamps are stored in UNIX time
Regardless of how time is specified in your events, timestamps are converted to UNIX time and stored in the
_time field when your data is indexed. If your data does not have timestamps, the time at which your data is indexed is used as the timestamp for your events.
UNIX time is the number of seconds that have elapsed since 00:00:00 Coordinated Universal Time (UTC), 1 January 1970. This moment in time is sometimes referred to as epoch time. UNIX time appears as a series of numbers, for example
1518632124. You can use any UNIX time converter to convert the UNIX time to either GMT or your local time.
GMT and UTC
GMT (Greenwich Mean Time) is sometimes confused with UTC (Coordinated Universal Time). However GMT is a time zone and UTC is a time standard.
- GMT is a time zone officially used in some European and African countries as their local time. The time is displayed in either the 24-hour format (00:00-23:59) or the 12-hour format (00:00-12:00 AM/PM).
- UTC is a time standard that is the basis for time and time zones worldwide. No country uses UTC as a local time.
- Neither GMT nor UTC ever change for Daylight Saving Time (DST). However, some of the countries that use GMT switch to different time zones during their DST period. For example, the United Kingdom uses GMT for most of the year, but switches to British Summer Time (BST) during the summer months. BST is one hour ahead of GMT.
The _time field
_time field appears in a human readable format in Splunk user interfaces. However, the values in the
_time field are stored in UNIX time.
Specify narrow time ranges
Splunk user interfaces use a default time range when you create a search. This range helps to avoid running searches with overly-broad time ranges that waste system resources and produce more results than you really need.
Whether you are running a new search, a report, or creating a dashboard, it is important to narrow the time range to only the dates or times that you really need.
Time is also crucial for determining what went wrong. You often know when something happened, if not exactly what happened. Looking at events that happened around the same time that something went wrong can help correlate results and find the root cause of the problem.
- Related information
- Select time ranges to apply to your search
- Specify time modifiers in your search
- Specify time ranges for real-time searches
- Use time to find nearby events
- How time zones are processed by the Splunk platform
- Date and time format variables in the Search Reference
- Time modifiers in the Search Reference
Select time ranges to apply to your search
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.10, 7.0.1, 8.0.2, 8.0.3, 8.0.7, 8.0.8, 8.0.9, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.1.0, 9.1.1, 9.1.2, 8.0.4, 8.0.5, 8.0.6