timestamp

timestamp

noun

A default field that represents time information in an event. Most events contain timestamps. In cases where an event does not contain timestamp information, Splunk Enterprise attempts to assign a timestamp value to the event at index time.

Splunk Enterprise uses timestamps to correlate events by time, to create the timeline histogram in Splunk Web, and to set time ranges for searches.

Related terms

• timezone offset

For more information

In the Knowledge Manager Manual:

• Use default fields

In Getting Data In:

• About default fields (host, source, sourcetype, and more)
• How timestamp assignment works