https://community.splunk.com/t5/Getting-Data-In/Time-Stamps-differences/m-p/20011#M2887 <P><CODE>TimeGenerated</CODE> is when the event occurred; <CODE>TimeWritten</CODE> is when it was written to the event log. Usually they'll be the same or very close.</P> <P>See also: <BR />&nbsp;&nbsp;&nbsp;&nbsp; <A href="http://msdn.microsoft.com/en-us/library/system.diagnostics.eventlogentry.timegenerated(v=vs.71).aspx" rel="nofollow">http://msdn.microsoft.com/en-us/library/system.diagnostics.eventlogentry.timegenerated(v=vs.71).aspx</A></P> Wed, 05 Jan 2011 01:03:56 GMT southeringtonp 2011-01-05T01:03:56Z https://community.splunk.com/t5/Getting-Data-In/Time-Stamps-differences/m-p/20010#M2886 <P>in my windows event logs I have: TimeGenerated=20101226191500.000000-360 TimeWritten=20101226191500.000000-360 what is the difference between these to time stamps and were do they come from?</P> Tue, 04 Jan 2011 06:31:31 GMT https://community.splunk.com/t5/Getting-Data-In/Time-Stamps-differences/m-p/20010#M2886 hartfoml 2011-01-04T06:31:31Z https://community.splunk.com/t5/Getting-Data-In/Time-Stamps-differences/m-p/20011#M2887 <P><CODE>TimeGenerated</CODE> is when the event occurred; <CODE>TimeWritten</CODE> is when it was written to the event log. Usually they'll be the same or very close.</P> <P>See also: <BR />&nbsp;&nbsp;&nbsp;&nbsp; <A href="http://msdn.microsoft.com/en-us/library/system.diagnostics.eventlogentry.timegenerated(v=vs.71).aspx" rel="nofollow">http://msdn.microsoft.com/en-us/library/system.diagnostics.eventlogentry.timegenerated(v=vs.71).aspx</A></P> Wed, 05 Jan 2011 01:03:56 GMT https://community.splunk.com/t5/Getting-Data-In/Time-Stamps-differences/m-p/20011#M2887 southeringtonp 2011-01-05T01:03:56Z