Is it better to specify TIME_FORMAT or let Splunk automatically determine time format?

[bolaojewale]

Hey,
I am currently doing clean up work on some of the in house TA's build for our environment. We are getting timestamps in a more consistent way on some sources and I was wondering what would improve indexer performance? We previously had the following time-related settings in our props.conf

TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 20

I want to remove the TIME_PREFIX and TIME_FORMAT settings and just leave MAX_TIMESTAMP_LOOKAHEAD.

Does this even matter?

[richgalloway · Accepted solution]

Always specify TIME_FORMAT, TIME_PREFIX, and MAX_TIMESTAMP_LOOKAHEAD. Without them, Splunk has to guess at where the timestamp is in your events. This impedes performance. If you want to clean up your TAs, add these attributes for the sourcetypes that are lacking them.