Getting Data In
Highlighted

should the data be indexed include timestamp

New Member

e.g. if the data be indexed is an application log, all the messages logged in this log file should contain a timestamp, otherwise the search result cannot display the "events" in a correct reverse chronicle sequence for troublshooting, right?

Tags (1)
0 Karma
Highlighted

Re: should the data be indexed include timestamp

Legend

Short answer: yes, events need a timestamp.

Slightly longer answer: events do not necessarily need a timestamp in order for Splunk to index them, however without a timestamp Splunk won't have the slightest idea when the event really occurred, so it will use the indexing time as timestamp. This can often be fine if Splunk is indexing events immediately as they arrive in an input source, however if you're adding some historical data the timestamp will be incorrect as the index time differs from the event generation time.

Highlighted

Re: should the data be indexed include timestamp

Splunk Employee
Splunk Employee

Not exactly true, but close. An explicit timestamp on each event is best, but Splunk does many things to try to guess the time before going to the "current" time, including looking at the file name, looking at the modification time of the file, and looking at the timestamp of previous events.

0 Karma