topic Re: Will Splunk index events older than 1970/1/1 ? in Splunk Search https://community.splunk.com/t5/Splunk-Search/Will-Splunk-index-events-older-than-1970-1-1/m-p/71861#M180906 <P>Stephen is correct regarding epoch time being greater than 0. 01 Jan 1970 00:00:00 UTC is epoch 0. </P> <P>Perhaps as a workaround you can try modifying the timestamp on your events?</P> Mon, 18 Oct 2010 22:35:33 GMT ftk 2010-10-18T22:35:33Z Will Splunk index events older than 1970/1/1 ? https://community.splunk.com/t5/Splunk-Search/Will-Splunk-index-events-older-than-1970-1-1/m-p/71859#M180904 <P>as Title , I have many events older than 1970/1/1 , Splunk doesn't index those events (I have modified max_days_ago=18250 in props.conf) </P> <P>is it because splunk's timestamp is from 1970/1/1 ? is there any work around ? thanks .</P> Mon, 18 Oct 2010 20:44:03 GMT https://community.splunk.com/t5/Splunk-Search/Will-Splunk-index-events-older-than-1970-1-1/m-p/71859#M180904 dmlee 2010-10-18T20:44:03Z Re: Will Splunk index events older than 1970/1/1 ? https://community.splunk.com/t5/Splunk-Search/Will-Splunk-index-events-older-than-1970-1-1/m-p/71860#M180905 <P>No, Splunk only supports events with an epoch time greater than zero.</P> Mon, 18 Oct 2010 22:04:37 GMT https://community.splunk.com/t5/Splunk-Search/Will-Splunk-index-events-older-than-1970-1-1/m-p/71860#M180905 Stephen_Sorkin 2010-10-18T22:04:37Z Re: Will Splunk index events older than 1970/1/1 ? https://community.splunk.com/t5/Splunk-Search/Will-Splunk-index-events-older-than-1970-1-1/m-p/71861#M180906 <P>Stephen is correct regarding epoch time being greater than 0. 01 Jan 1970 00:00:00 UTC is epoch 0. </P> <P>Perhaps as a workaround you can try modifying the timestamp on your events?</P> Mon, 18 Oct 2010 22:35:33 GMT https://community.splunk.com/t5/Splunk-Search/Will-Splunk-index-events-older-than-1970-1-1/m-p/71861#M180906 ftk 2010-10-18T22:35:33Z Re: Will Splunk index events older than 1970/1/1 ? https://community.splunk.com/t5/Splunk-Search/Will-Splunk-index-events-older-than-1970-1-1/m-p/71862#M180907 <P>Are these events from a time machine that you used to travel back in time?</P> Tue, 19 Oct 2010 10:26:49 GMT https://community.splunk.com/t5/Splunk-Search/Will-Splunk-index-events-older-than-1970-1-1/m-p/71862#M180907 araitz 2010-10-19T10:26:49Z