All Apps and Add-ons

How to get the latest logs from a source which does not have timestamp

vrmandadi
Builder

I have configured an input through REST API to get data into splunk .Recently I have disabled one input since there was high volume of data coming in.If we enable it back do we get all the historical data , since there is no time stamp? . How to get only the latest data from the time it was enabled and ignore the historical data

Sample event:

[quartzJobExecutor-1] INFO c.c.c.r.c.s.m.i.DataSetMatcherServiceImpl - Computing similarity scores took 0 ms

0 Karma

woodcock
Esteemed Legend

It depends on the design of the input. The developer should have documented how it works.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It depends on the API being used. Some will return all events if no start time is specified, but have a limit to how far back they will go.

Why do you not have a timestamp? You could set DATETIME_CONFIG = current for the sourcetype to ensure all events get a timestamp.

---
If this reply helps you, Karma would be appreciated.
0 Karma

vrmandadi
Builder

The source by default dont have timestamp. If we set DATETIME_CONFIG = current , does it ignore historical data and gets only the data at the time of configuration

0 Karma

richgalloway
SplunkTrust
SplunkTrust

DATETIME_CONFIG = current assigns a timestamp to events as they are indexed. It doesn't affect data already indexed. Having a timestamp on your data means you can pick up where you left off.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...