About searching with time

You can use time to narrow your search and to group events in your search by time.

How timestamps are used

Timestamp processing is a key step in event processing. Splunk software uses timestamps to:

• Correlate events by time
• Create the timeline histogram in Splunk Web
• Set time ranges for searches

Timestamps are stored in UNIX time

Regardless of how time is specified in your events, timestamps are converted to UNIX time and stored in the _time field when your data is indexed. If your data does not have timestamps, the time at which your data is indexed is used as the timestamp for your events.

UNIX time is the number of seconds that have elapsed since 00:00:00 Coordinated Universal Time (UTC), 1 January 1970. This moment in time is sometimes referred to as epoch time. UNIX time appears as a series of numbers, for example 1518632124. You can use any UNIX time converter to convert the UNIX time to either GMT or your local time.

GMT and UTC

GMT (Greenwich Mean Time) is sometimes confused with UTC (Coordinated Universal Time). However GMT is a time zone and UTC is a time standard.

• GMT is a time zone officially used in some European and African countries as their local time. The time is displayed in either the 24-hour format (00:00-23:59) or the 12-hour format (00:00-12:00 AM/PM).
• UTC is a time standard that is the basis for time and time zones worldwide. No country uses UTC as a local time.
• Neither GMT nor UTC ever change for Daylight Saving Time (DST). However, some of the countries that use GMT switch to different time zones during their DST period. For example, the United Kingdom uses GMT for most of the year, but switches to British Summer Time (BST) during the summer months. BST is one hour ahead of GMT.

The _time field

The _time field appears in a human readable format in Splunk user interfaces. However, the values in the _time field are stored in UNIX time.

Specify narrow time ranges

Splunk user interfaces use a default time range when you create a search. This range helps to avoid running searches with overly-broad time ranges that waste system resources and produce more results than you really need.

Whether you are running a new search, a report, or creating a dashboard, it is important to narrow the time range to only the dates or times that you really need.

Time is also crucial for determining what went wrong. You often know when something happened, if not exactly what happened. Looking at events that happened around the same time that something went wrong can help correlate results and find the root cause of the problem.

See also

Related information

Select time ranges to apply to your search

Specify time modifiers in your search

Specify time ranges for real-time searches

Use time to find nearby events

How time zones are processed by the Splunk platform

Date and time format variables in the Search Reference

Time modifiers in the Search Reference