Getting Data In

Is it better to specify TIME_FORMAT or let Splunk automatically determine time format?

bolaojewale
Explorer

Hey,
I am currently doing clean up work on some of the in house TA's build for our environment. We are getting timestamps in a more consistent way on some sources and I was wondering what would improve indexer performance? We previously had the following time-related settings in our props.conf

TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 20

I want to remove the TIME_PREFIX and TIME_FORMAT settings and just leave MAX_TIMESTAMP_LOOKAHEAD.

Does this even matter?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Always specify TIME_FORMAT, TIME_PREFIX, and MAX_TIMESTAMP_LOOKAHEAD. Without them, Splunk has to guess at where the timestamp is in your events. This impedes performance. If you want to clean up your TAs, add these attributes for the sourcetypes that are lacking them.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Always specify TIME_FORMAT, TIME_PREFIX, and MAX_TIMESTAMP_LOOKAHEAD. Without them, Splunk has to guess at where the timestamp is in your events. This impedes performance. If you want to clean up your TAs, add these attributes for the sourcetypes that are lacking them.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!