topic Is it better to specify TIME_FORMAT or let Splunk automatically determine time format? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Is-it-better-to-specify-TIME-FORMAT-or-let-Splunk-automatically/m-p/473033#M81291 <P>Hey,<BR /> I am currently doing clean up work on some of the in house TA's build for our environment. We are getting timestamps in a more consistent way on some sources and I was wondering what would improve indexer performance? We previously had the following time-related settings in our props.conf</P> <PRE><CODE>TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 20 </CODE></PRE> <P>I want to remove the TIME_PREFIX and TIME_FORMAT settings and just leave MAX_TIMESTAMP_LOOKAHEAD.</P> <P>Does this even matter?</P> Wed, 30 Sep 2020 03:29:28 GMT bolaojewale 2020-09-30T03:29:28Z Is it better to specify TIME_FORMAT or let Splunk automatically determine time format? https://community.splunk.com/t5/Getting-Data-In/Is-it-better-to-specify-TIME-FORMAT-or-let-Splunk-automatically/m-p/473033#M81291 <P>Hey,<BR /> I am currently doing clean up work on some of the in house TA's build for our environment. We are getting timestamps in a more consistent way on some sources and I was wondering what would improve indexer performance? We previously had the following time-related settings in our props.conf</P> <PRE><CODE>TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 20 </CODE></PRE> <P>I want to remove the TIME_PREFIX and TIME_FORMAT settings and just leave MAX_TIMESTAMP_LOOKAHEAD.</P> <P>Does this even matter?</P> Wed, 30 Sep 2020 03:29:28 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-better-to-specify-TIME-FORMAT-or-let-Splunk-automatically/m-p/473033#M81291 bolaojewale 2020-09-30T03:29:28Z Re: Is it better to specify TIME_FORMAT or let Splunk automatically determine time format? https://community.splunk.com/t5/Getting-Data-In/Is-it-better-to-specify-TIME-FORMAT-or-let-Splunk-automatically/m-p/473034#M81292 <P>Always specify <CODE>TIME_FORMAT</CODE>, <CODE>TIME_PREFIX</CODE>, and <CODE>MAX_TIMESTAMP_LOOKAHEAD</CODE>. Without them, Splunk has to guess at where the timestamp is in your events. This impedes performance. If you want to clean up your TAs, add these attributes for the sourcetypes that are lacking them.</P> Fri, 27 Dec 2019 20:54:41 GMT https://community.splunk.com/t5/Getting-Data-In/Is-it-better-to-specify-TIME-FORMAT-or-let-Splunk-automatically/m-p/473034#M81292 richgalloway 2019-12-27T20:54:41Z