Time stamp handling

[rdonohue]

I understand that the Prometheus data format has the timestamp at the end of the 'event'. how is this handled? Does splunk ignore the epoc time stamp at the end? does it use it? or do you rely on using index time vs, event time?

[luke_monahan]

The Prometheus server will always append the timestamp. If you are getting your metrics from the Prometheus server, whether you are using federation or remote write, the input will use the Prometheus provided timestamp.

If you are polling a simple exporter instead, the timestamp may or may not be present as it's optional. If it's present it will be used, but if it's not present the time the poll occurred will be used. This may be slightly different to the _indextime as it will be the time on the forwarder that is doing the polling.