What time should be when searching old logs?

[dujas]

I am using Splunk searching old log files and the _time is different from log time, would this make sense or do I have to parse the log to set  _time to log time?

Thanks.

[gcusello · Accepted solution]

Hi @dujas,

yes, usually the event timestamp (_time) is the same of the event.

You have to better parse your logs to have as timestamp, the event timestamp.

Ciao.

Giuseppe

[dujas]

Thanks @gcusello , I have parsed the log line and made it work.

[gcusello]

Hi @dujas,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉