Splunk Search

Will Splunk index events older than 1970/1/1 ?

dmlee
Communicator

as Title , I have many events older than 1970/1/1 , Splunk doesn't index those events (I have modified max_days_ago=18250 in props.conf)

is it because splunk's timestamp is from 1970/1/1 ? is there any work around ? thanks .

Tags (1)
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

No, Splunk only supports events with an epoch time greater than zero.

View solution in original post

araitz
Splunk Employee
Splunk Employee

Are these events from a time machine that you used to travel back in time?

ftk
Motivator

Stephen is correct regarding epoch time being greater than 0. 01 Jan 1970 00:00:00 UTC is epoch 0.

Perhaps as a workaround you can try modifying the timestamp on your events?

Stephen_Sorkin
Splunk Employee
Splunk Employee

No, Splunk only supports events with an epoch time greater than zero.

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>