How can I overwrite _time upon inserting data into Splunk?

sccheah82 — Thu, 02 Mar 2023 15:26:44 GMT

I have data dated "2-14-2022".

When I insert the data into Splunk today, the _time becomes "3-2-2023".

How can I overwrite _time to preserve the value as "2-14-2022" even though I insert the data at "3-2-2023", without creating an additional field to store the snapshot of datetime?

The reason I would like to do that is because

(1) I can leverage on the Splunk Time Range selector to limit my search query, instead of creating the time range selector myself.

(2) I observed the query turnaround time is faster if we limit the data by earliest=1677686400 latest=1677980130 (2.2 seconds query turnaround time) than using start_date & end_date that are associated to the custom input fields that I created (*194 seconds query turnaround time).

Re: How can I overwrite _time upon inserting data into Splunk?

tscroggins — Sun, 12 Mar 2023 20:02:44 GMT

@sccheah82

Hi,

If you're uploading data through Splunk Web, you can adjust line breaking and timestamp extraction on the Set Source Type page.

2-14-2022 Example one.
 2-14-2022 Example two with leading space.
(empty line)

Note that very old events (> 900 days by default but perhaps earlier in your environment) may be quarantined (written to a separate bucket), and depending on your environment's retention settings, may not remain online for as long as you'd hoped. Check with your Splunk administrator for your environment's specific characteristics.

topic How can I overwrite _time upon inserting data into Splunk? in All Apps and Add-ons

How can I overwrite _time upon inserting data into Splunk?

Re: How can I overwrite _time upon inserting data into Splunk?