Getting Data In

Indexing of data that does not have timestamp but just date

Path Finder

How do we index a data file which is an aggregated data for a given day. The data does not contain timestamp.
Splunk gives an error while searching- saying that "Error in IndexScopedSearch: The search failed. More than XXX events found at time t"

I've looked at these forums and found the following link, which tells me its a limitation on Splunk.

  1. Max number events at the same timestamp
  2. Tuning Search with more than 250K events at one timestamp
  3. Disable timestamp processor

Consider the following use-case.
Imagine, you are looking at a stock price data on a day-scale for 6 months. The data file in this case, may contain ticker price for a given day. If the data points are more than 100K, since there is no timestamp, Splunk given the error during search time.

Has anyone figured how to workaround this?

0 Karma

Path Finder

Sounds like a good candidate for a daily summary. This way, you would have one value per day (or one value per hour) --or several values such as avg, max, min, etc.--depending on the level of granularity you want. This could make it easy to see a larger (yearly) timeframe.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...