topic Re: Time for Data ( _time ) in Security

Time for Data ( _time )

jimjohn — Wed, 29 Jan 2014 11:19:40 GMT

Can anybody explain how _time of splunk get populated.
When i read data from data base i can see diffrent date in _time filed.
My understanding is that _time is the time when data is fetched from DB.
Is there anyway to give fetching time to _time field when trying to read from DB

Re: Time for Data ( _time )

alacercogitatus — Wed, 29 Jan 2014 12:22:37 GMT

_time is set according to the event. If there is a timestamp available, then _time is that value. If there is no timestamp - such as a DB fetch - the _time should be the time at which the DB information was 1) fetched or 2) indexed - depending on how your input is setup.

You can force the timestamp using props.conf. This "will set the time of the event to the time that the event was merged from lines, or worded differently, the time it passed through the aggregator processor." [1]

[your_sourcetype]
DATETIME_CONFIG = CURRENT

[1] http://docs.splunk.com/Documentation/Splunk/6.0.1/admin/propsconf

Re: Time for Data ( _time )

Ayn — Wed, 29 Jan 2014 12:23:24 GMT

http://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps

Re: Time for Data ( _time )

kristian_kolb — Wed, 29 Jan 2014 12:54:18 GMT

Did you see the documentation for DB Connect?

output.timestamp.column = <string>
* The column of the result set from which the timestamp is fetched. If this is omitted, the monitor execution time is used as the timestamp value.

http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/inputsspec