topic Re: How is _time being populated? in Splunk Search

How is _time being populated?

ddrillic — Wed, 11 May 2016 13:55:37 GMT

I wonder how _time is being populated by default. Is it "simply" by assigning the first date/time field into _time?

Re: How is _time being populated?

somesoni2 — Wed, 11 May 2016 14:09:47 GMT

Population/calculation of _time, also known as timestamp recognition, is done during indexing of the data. This link should give you all the information you need.

http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/HowSplunkextractstimestamps

Re: How is _time being populated?

ddrillic — Tue, 29 Sep 2020 09:40:20 GMT

That's great. It says -

2 ---
If no TIME_FORMAT was configured for the data, Splunk Enterprise attempts to automatically identify a time or date in the event itself. It uses the source type of the event (which includes TIME_FORMAT information) to try to find the timestamp.

Does it mean that if there are multiple candidates in the event, it takes the first one it encounters, left to right?

Re: How is _time being populated?

somesoni2 — Wed, 11 May 2016 16:02:01 GMT

That is correct

Re: How is _time being populated?

somesoni2 — Tue, 29 Sep 2020 09:41:10 GMT

Not sure if my previous comment was saved, Yes that is correct.

But again it's always better to specify TIME_FORMAT and TIME_PREFIX (location of timestamp) to reduce additional data parsing load on Splunk.

Re: How is _time being populated?

ddrillic — Wed, 11 May 2016 17:59:22 GMT

Perfect - thank you!!!