All Apps and Add-ons

Time stamp handling

New Member

I understand that the Prometheus data format has the timestamp at the end of the 'event'. how is this handled? Does splunk ignore the epoc time stamp at the end? does it use it? or do you rely on using index time vs, event time?

0 Karma

Path Finder

The Prometheus server will always append the timestamp. If you are getting your metrics from the Prometheus server, whether you are using federation or remote write, the input will use the Prometheus provided timestamp.

If you are polling a simple exporter instead, the timestamp may or may not be present as it's optional. If it's present it will be used, but if it's not present the time the poll occurred will be used. This may be slightly different to the _indextime as it will be the time on the forwarder that is doing the polling.

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...