topic How Splunk DB manages data which has record of same timestamp in Getting Data In

How Splunk DB manages data which has record of same timestamp

snehal8 — Fri, 05 Apr 2013 07:00:40 GMT

Hello everyone,

i read this following link

Now i have one question in my mind,what happen when more than 10 records has same time stamp in database,then how splunk will handle this. it take which record came fast?

i know this is silly question,but i want to clear how process will go.

thank you

Re: How Splunk DB manages data which has record of same timestamp

jbsplunk — Fri, 05 Apr 2013 10:29:06 GMT

Splunk can index up to 100,000 records with the same time stamp. After that we'll start to increment the timestamp. For a detailed discussion of this, please see:

http://splunk-base.splunk.com/answers/303/whats-max-events-i-can-have-timestamped-with-a-particular-second-millisecond

Re: How Splunk DB manages data which has record of same timestamp

snehal8 — Fri, 05 Apr 2013 11:11:10 GMT

Thank you.