Getting Data In

Time notions in event processing

oaken
New Member

Hello everyone,

I was reading through the docs and a question came to my mind.

Does Splunk have different notions of time that exists in stream processing products like Flink or Kafka? Flink has event time, ingestion time and processing time for all the events that arrive and uses complex algorithms for handling event time and processing time differences, like watermarks.

From what I see from the docs, Splunk has a single concept of time in the form of timestamps that are added to the events that arrive at the system and ignores the event time, the actual time when the event has been created.

Am I right or am I missing something?

Thanks.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Splunk tries to allocate a useful timestamp to the events. This is configurable so if the events are described correctly, the "event time" (if present in the data) can be used. If all else fails, the time that the event is processed is used. So, splunk doesn't really have a single notion of time, it tries to use the most useful available to it. If there are other timestamps within the data, these can still be extracted, e.g. an event may have a start and an end time within the event, these could be extracted into separate fields for the event and one or other or neither be assigned to the timestamp for the event.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...