topic Re: What time should be when searching old logs? in Splunk Search

What time should be when searching old logs?

dujas — Wed, 15 Feb 2023 14:53:46 GMT

I am using Splunk searching old log files and the _time is different from log time, would this make sense or do I have to parse the log to set _time to log time?

Thanks.

Re: What time should be when searching old logs?

gcusello — Wed, 15 Feb 2023 15:04:02 GMT

Hi @dujas,

yes, usually the event timestamp (_time) is the same of the event.

You have to better parse your logs to have as timestamp, the event timestamp.

Ciao.

Giuseppe

Re: What time should be when searching old logs?

dujas — Sat, 18 Feb 2023 10:03:41 GMT

Thanks @gcusello , I have parsed the log line and made it work.

Re: What time should be when searching old logs?

gcusello — Sat, 18 Feb 2023 11:29:31 GMT

Hi @dujas,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉