Splunk Search

Events recevie date & time

rossikwan
Path Finder

After the events received, how to identify the events receiving date & time?

Tags (3)
0 Karma

Ayn
Legend

This information is available in the field _indextime. To make it "visible" for whatever purpose you're using it for you might want to use eval. For instance

... | eval indextime=_indextime | convert ctime(indextime) | table indextime

datasearchninja
Communicator

Are you asking how Splunk assigns a timestamp to events coming into Splunk?

See the documentation at http://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps

Splunk uses the following precedence rules to assign timestamps to events:

  1. Splunk looks for a time or date in the event itself using an explicit TIME_FORMAT, if provided. You configure TIME_FORMAT in props.conf.

  2. If no TIME_FORMAT was configured for the data, Splunk attempts to automatically identify a time or date in the event itself. It uses the event's source type (which includes TIME_FORMAT information) to try to find the timestamp.

  3. If an event doesn't have a time or date, Splunk uses the timestamp from the most recent previous event of the same source.

  4. If no events in a source have a date, Splunk tries to find one in the source name or file name. (This requires that the events have a time, even though they don't have a date.)

  5. For file sources, if no time or date can be identified in the file name, Splunk uses the file's modification time.

  6. As a last resort, Splunk sets the timestamp to the current system time when indexing each event.

rossikwan
Path Finder

Thanks and could there a method to show when did that event indexed in Splunk?

0 Karma

vincesesto
Communicator

Hey rossikwan...can we get a little more information here. What is the data you are trying to put into splunk and let us know what it is displaying as date and time?
Regards Vince

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...