https://community.splunk.com/t5/Getting-Data-In/newbie-question-on-timeline-extraction/m-p/99381#M20788 <P>Pls excuse me if this is a really silly question. I cannot find an easy answer in the kb. I have a file which I'm trying to analyse with incomplete timestamps on most events (no date). It's full of debugging information from various technologies and does have some date hints (specific line formats contain date timestamps. Although the file only represents 5 day's of events, splunk is building a timeline going back into 2009. Where do I start to fix this?</P> <P>What's the timeline interpretation model and how do I influence it to get the correct timeline.</P> <P>tia</P> <P>Tim</P> Wed, 11 May 2011 08:06:55 GMT timcoote 2011-05-11T08:06:55Z https://community.splunk.com/t5/Getting-Data-In/newbie-question-on-timeline-extraction/m-p/99381#M20788 <P>Pls excuse me if this is a really silly question. I cannot find an easy answer in the kb. I have a file which I'm trying to analyse with incomplete timestamps on most events (no date). It's full of debugging information from various technologies and does have some date hints (specific line formats contain date timestamps. Although the file only represents 5 day's of events, splunk is building a timeline going back into 2009. Where do I start to fix this?</P> <P>What's the timeline interpretation model and how do I influence it to get the correct timeline.</P> <P>tia</P> <P>Tim</P> Wed, 11 May 2011 08:06:55 GMT https://community.splunk.com/t5/Getting-Data-In/newbie-question-on-timeline-extraction/m-p/99381#M20788 timcoote 2011-05-11T08:06:55Z https://community.splunk.com/t5/Getting-Data-In/newbie-question-on-timeline-extraction/m-p/99382#M20789 <P>The best starting point is here:<BR /> <BR />&nbsp;&nbsp;&nbsp;&nbsp;<BR /> <A href="http://www.splunk.com/base/Documentation/latest/Data/HowSplunkextractstimestamps">http://www.splunk.com/base/Documentation/latest/Data/HowSplunkextractstimestamps</A></P> <P>If you're seeing events that are that old, it's also possible that Splunk is seeing something in the data that it incorrectly thinks is a timestamp. If so, you may need to look at the <CODE>MAX_TIMESTAMP_LOOKAHEAD</CODE>, <CODE>TIME_PREFIX</CODE>, and <CODE>TIME_FORMAT</CODE> settings in <A href="http://www.splunk.com/base/Documentation/4.2.1/admin/Propsconf">props.conf</A>.</P> <P>If that doesn't help, you might want to post a sample of your log file.</P> Wed, 11 May 2011 12:39:19 GMT https://community.splunk.com/t5/Getting-Data-In/newbie-question-on-timeline-extraction/m-p/99382#M20789 southeringtonp 2011-05-11T12:39:19Z