Splunk Search

How is _time being populated?

ddrillic
Ultra Champion

I wonder how _time is being populated by default. Is it "simply" by assigning the first date/time field into _time?

Tags (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Population/calculation of _time, also known as timestamp recognition, is done during indexing of the data. This link should give you all the information you need.

http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/HowSplunkextractstimestamps

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Population/calculation of _time, also known as timestamp recognition, is done during indexing of the data. This link should give you all the information you need.

http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/HowSplunkextractstimestamps

ddrillic
Ultra Champion

That's great. It says -

2 ---
If no TIME_FORMAT was configured for the data, Splunk Enterprise attempts to automatically identify a time or date in the event itself. It uses the source type of the event (which includes TIME_FORMAT information) to try to find the timestamp.

Does it mean that if there are multiple candidates in the event, it takes the first one it encounters, left to right?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Not sure if my previous comment was saved, Yes that is correct.

But again it's always better to specify TIME_FORMAT and TIME_PREFIX (location of timestamp) to reduce additional data parsing load on Splunk.

0 Karma

ddrillic
Ultra Champion

Perfect - thank you!!!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

That is correct

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...