ISO8601 Segmenter Configuration

Splunk Community

ISO8601 Segmenter Configuration

ISO8601 Segmenter Configuration
This add-on will configure Splunk to not consider an ISO8601 timestamp when generating the index. It will save significant disk space at the cost of not being able to search free text on timestamps. i.e. it's no longer possible to search for terms like '2018'. Normal search by time of course still works. This app will not work in Splunk Cloud. It modifies the `segmenters.conf` and this only supported in on-premises deployments.
0 topics and 0 replies mentioned ISO8601 Segmenter Configuration in
Latest Topics
No posts to display.
Latest Replies
No posts to display.
Top Topics
No posts to display.
My Topics
No posts to display.