topic Re: Event Detail ++ _time field "+" icon in Getting Data In

Event Detail ++ _time field "+" icon

verbal_666 — Wed, 03 Apr 2024 04:09:08 GMT

Hi there.
Did you saw in many events, exploding the event to detail, the _time field has a "+" icon on its side?

Exploding it, give the detail of created _time field,

What's that?

In other events i can't see the "+" icon, also on same server/path/log,

Is it some kind of,

"+" == I, SPLUNK INDEXER, ELABORATED THE TIMESTAMP WITH MY ALGORITHMS BY MYSELF IN THIS WAY

clean, no "+" == automatic timestamp calculation, no elaboration, i found it yet cooked

Thanks.

Re: Event Detail ++ _time field "+" icon

scelikok — Wed, 03 Apr 2024 04:24:32 GMT

Hi @verbal_666,

You can see related documentation below about timestamp information. The events that missing date_* fields may not have extracted time inside.

https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usedefaultfields#Use_default_fields

Only events that have timestamp information in them as generated by their respective systems will have date_* fields. If an event has a date_* field, it represents the value of time/date directly from the event itself. If you have specified any timezone conversions or changed the value of the time/date at indexing or input time (for example, by setting the timestamp to be the time at index or input time), these fields will not represent that.

Re: Event Detail ++ _time field "+" icon

verbal_666 — Wed, 03 Apr 2024 04:58:18 GMT

Clear.
So, an event with _time field with "+", in practice, represents a complete _time extraction with all "date_*" underfields inside 👍
Thanks 👏👏