- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Timestamp is not recognized
zhou51
New Member
05-20-2020
07:22 PM
Use splunk enterprise version 7.2.3,Use the field to extract the timestamp, the time closer to the present can be identified, and the historical time cannot be identified, how to solve
help!help
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
to4kawa
Ultra Champion
05-23-2020
04:18 PM
what's INDEXED_EXTRACTION
in props.conf ?
and you should fix indexes.conf
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf
frozenTimePeriodInSecs = < nonnegative integer>
* The number of seconds after which indexed data rolls to frozen.
* If you do not specify a 'coldToFrozenScript', data is deleted when rolled to frozen.
* NOTE: Every event in a bucket must be older than frozenTimePeriodInSecs
seconds before the bucket rolls to frozen.
* The highest legal value is 4294967295.
* Default: 188697600 (6 years)
