Splunk Cloud Platform

Getting Data In

Configure event timestamps

You can control how the Splunk platform handles timestamps in both Splunk Cloud Platform and Splunk Enterprise.

Examine this event example: - - [01/Jul/2017:12:05:27 -0700] "GET /trade/app?action=logout HTTP/1.1" 200 2953

The time information in the event, [01/Jul/2017:12:05:27 -0700], is a timestamp.

The Splunk platform uses timestamps to correlate events by time, create the histogram in Splunk Web, and set time ranges for searches. Most events contain timestamps, and in cases where an event doesn't have timestamp information, the Splunk platform attempts to assign a timestamp value to the event at index time.

In most cases, the Splunk platform extracts timestamps correctly, but there are situations where you might need to configure timestamp handling yourself. For example, when dealing with distributed deployments, you might need to reconfigure timestamp recognition and formatting.

See the Configure timestamps chapter of this manual for specific instructions on how to configure timestamps.

Last modified on 27 October, 2021
Configure event line breaking   Configure indexed field extraction

This documentation applies to the following versions of Splunk Cloud Platform: 8.2.2112, 8.2.2201, 8.2.2202, 9.0.2205, 8.2.2203, 9.0.2208, 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308 (latest FedRAMP release), 9.1.2312, 9.2.2403

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters