newbie question on timeline extraction

[timcoote]

Pls excuse me if this is a really silly question. I cannot find an easy answer in the kb. I have a file which I'm trying to analyse with incomplete timestamps on most events (no date). It's full of debugging information from various technologies and does have some date hints (specific line formats contain date timestamps. Although the file only represents 5 day's of events, splunk is building a timeline going back into 2009. Where do I start to fix this?

What's the timeline interpretation model and how do I influence it to get the correct timeline.

tia

Tim

[southeringtonp]

The best starting point is here:

    
http://www.splunk.com/base/Documentation/latest/Data/HowSplunkextractstimestamps

If you're seeing events that are that old, it's also possible that Splunk is seeing something in the data that it incorrectly thinks is a timestamp. If so, you may need to look at the MAX_TIMESTAMP_LOOKAHEAD, TIME_PREFIX, and TIME_FORMAT settings in props.conf.

If that doesn't help, you might want to post a sample of your log file.