https://community.splunk.com/t5/Getting-Data-In/what-do-the-indexed-fields-timeendpos-and-timestartpos-represent/m-p/99961#M20876 <P>They mean just how far into the event that Splunk thinks (usually correct) that your timestamp goes.</P> <P>timestartpos (at which byte the timestamp starts)<BR /> timeendpos (at which bye into the event the timestamp ends)</P> <P>If you are experiencing timestamping issues, you should look into how you can alter this behaviour through props.conf settings for your sourcetype;</P> <PRE><CODE>TIMESTAMP_LOOKAHEAD = number TIME_FORMAT = strftime format TIME_PREFIX = regex </CODE></PRE> <P>Hope this helps,</P> <P>Kristian</P> Fri, 23 Mar 2012 01:47:22 GMT kristian_kolb 2012-03-23T01:47:22Z https://community.splunk.com/t5/Getting-Data-In/what-do-the-indexed-fields-timeendpos-and-timestartpos-represent/m-p/99960#M20875 <P>I am new to Splunk.</P> <P>What do the indexed fields <CODE>timeendpos</CODE> and <CODE>timestartpos</CODE> represent?</P> <P>Since one report the company asks for from our archived Apache log files is the duration of the longest queries, I am curious about these fields and how to translate the corresponding integer values, if they have meaning.</P> Fri, 23 Mar 2012 00:50:16 GMT https://community.splunk.com/t5/Getting-Data-In/what-do-the-indexed-fields-timeendpos-and-timestartpos-represent/m-p/99960#M20875 boris 2012-03-23T00:50:16Z https://community.splunk.com/t5/Getting-Data-In/what-do-the-indexed-fields-timeendpos-and-timestartpos-represent/m-p/99961#M20876 <P>They mean just how far into the event that Splunk thinks (usually correct) that your timestamp goes.</P> <P>timestartpos (at which byte the timestamp starts)<BR /> timeendpos (at which bye into the event the timestamp ends)</P> <P>If you are experiencing timestamping issues, you should look into how you can alter this behaviour through props.conf settings for your sourcetype;</P> <PRE><CODE>TIMESTAMP_LOOKAHEAD = number TIME_FORMAT = strftime format TIME_PREFIX = regex </CODE></PRE> <P>Hope this helps,</P> <P>Kristian</P> Fri, 23 Mar 2012 01:47:22 GMT https://community.splunk.com/t5/Getting-Data-In/what-do-the-indexed-fields-timeendpos-and-timestartpos-represent/m-p/99961#M20876 kristian_kolb 2012-03-23T01:47:22Z