Splunk Search

How to make _time field to get the exact value of timestamp ?

ethanthomas
Path Finder

I have diffeence between _time and timestamp in terms of second . ( 5  to 50) . How to make the _time to get the exact value as timestamp ? any quick query will do other than modifying the propd conf file ? What values in props.conf file should be changed to make this success ?

Labels (1)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Normally those should be the same. Can you give sample events and also your props.conf definitions?

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...