Getting Data In

should the data be indexed include timestamp

amywong
New Member

e.g. if the data be indexed is an application log, all the messages logged in this log file should contain a timestamp, otherwise the search result cannot display the "events" in a correct reverse chronicle sequence for troublshooting, right?

Tags (1)
0 Karma

Ayn
Legend

Short answer: yes, events need a timestamp.

Slightly longer answer: events do not necessarily need a timestamp in order for Splunk to index them, however without a timestamp Splunk won't have the slightest idea when the event really occurred, so it will use the indexing time as timestamp. This can often be fine if Splunk is indexing events immediately as they arrive in an input source, however if you're adding some historical data the timestamp will be incorrect as the index time differs from the event generation time.

gkanapathy
Splunk Employee
Splunk Employee

Not exactly true, but close. An explicit timestamp on each event is best, but Splunk does many things to try to guess the time before going to the "current" time, including looking at the file name, looking at the modification time of the file, and looking at the timestamp of previous events.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...