https://community.splunk.com/t5/Getting-Data-In/Timestamp-is-not-recognized/m-p/460804#M99475 <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8952i770088B0C00BA79A/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Use splunk enterprise version 7.2.3，Use the field to extract the timestamp, the time closer to the present can be identified, and the historical time cannot be identified, how to solve</P> <P>help！help</P> Thu, 21 May 2020 02:22:14 GMT zhou51 2020-05-21T02:22:14Z https://community.splunk.com/t5/Getting-Data-In/Timestamp-is-not-recognized/m-p/460804#M99475 <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8952i770088B0C00BA79A/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Use splunk enterprise version 7.2.3，Use the field to extract the timestamp, the time closer to the present can be identified, and the historical time cannot be identified, how to solve</P> <P>help！help</P> Thu, 21 May 2020 02:22:14 GMT https://community.splunk.com/t5/Getting-Data-In/Timestamp-is-not-recognized/m-p/460804#M99475 zhou51 2020-05-21T02:22:14Z https://community.splunk.com/t5/Getting-Data-In/Timestamp-is-not-recognized/m-p/460805#M99476 <P>what's <CODE>INDEXED_EXTRACTION</CODE> in props.conf ?</P> <P>and you should fix indexes.conf</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf">https://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf</A></P> <P>frozenTimePeriodInSecs = &lt; nonnegative integer&gt;<BR /> * The number of seconds after which indexed data rolls to frozen.<BR /> * If you do not specify a 'coldToFrozenScript', data is deleted when rolled to frozen.<BR /> * NOTE: Every event in a bucket must be older than <CODE>frozenTimePeriodInSecs</CODE> seconds before the bucket rolls to frozen.<BR /> * The highest legal value is 4294967295.<BR /> * Default: 188697600 (6 years)</P> <P>reference: <A href="https://conf.splunk.com/files/2017/slides/splunk-data-life-cycle-determining-when-and-where-to-roll-data.pdf">https://conf.splunk.com/files/2017/slides/splunk-data-life-cycle-determining-when-and-where-to-roll-data.pdf</A></P> Sat, 23 May 2020 23:18:07 GMT https://community.splunk.com/t5/Getting-Data-In/Timestamp-is-not-recognized/m-p/460805#M99476 to4kawa 2020-05-23T23:18:07Z