Splunk Search

Question about "_time" field

zacksoft
Contributor

In Splunk I see this built in field "_time". I am able to use it in my stats and and it gives me some time.

My question is,
Does this field give the time when the event was generated by my corresponding "source server"?
OR
Does this field give me the time of when that event was indexed by the "Splunk server" ?

Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI @zacksoft,

Does this field give the time when the event was generated by my corresponding "source server"? : No Not directly.
OR
Does this field give me the time of when that event was indexed by the "Splunk server"?

Splunk software uses the following precedence rules to assign timestamps to events:

  • It looks for a time or date in the event itself using an explicit TIME_FORMAT, if provided. You configure the TIME_FORMAT attribute in props.conf.
  • If no TIME_FORMAT was configured for the data, Splunk software attempts to automatically identify a time or date in the event itself. It uses the source type of the event (which includes TIME_FORMAT information) to try to find the timestamp.
  • If an event has a time and date, but not a year, Splunk software determines the year, as described in How Splunk software determines timestamps with no year, and builds the timestamp from that.
  • If no events in a source have a date, Splunk software tries to find a date in the source name or file name. Time of day is not identified in filenames. (This requires that the events have a time, even though they don't have a date.)
  • For file sources, if no date can be identified in the file name, Splunk software uses the file modification time.
  • As a last resort, Splunk software sets the timestamp to the current system time when indexing each event.

Check this link:
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/HowSplunkextractstimestamps

Thanks
Kamlesh

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI @zacksoft,

Does this field give the time when the event was generated by my corresponding "source server"? : No Not directly.
OR
Does this field give me the time of when that event was indexed by the "Splunk server"?

Splunk software uses the following precedence rules to assign timestamps to events:

  • It looks for a time or date in the event itself using an explicit TIME_FORMAT, if provided. You configure the TIME_FORMAT attribute in props.conf.
  • If no TIME_FORMAT was configured for the data, Splunk software attempts to automatically identify a time or date in the event itself. It uses the source type of the event (which includes TIME_FORMAT information) to try to find the timestamp.
  • If an event has a time and date, but not a year, Splunk software determines the year, as described in How Splunk software determines timestamps with no year, and builds the timestamp from that.
  • If no events in a source have a date, Splunk software tries to find a date in the source name or file name. Time of day is not identified in filenames. (This requires that the events have a time, even though they don't have a date.)
  • For file sources, if no date can be identified in the file name, Splunk software uses the file modification time.
  • As a last resort, Splunk software sets the timestamp to the current system time when indexing each event.

Check this link:
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/HowSplunkextractstimestamps

Thanks
Kamlesh

View solution in original post

zacksoft
Contributor

Thanks Kamlesh.

0 Karma

nikita_p
Contributor

Hi @zacksoft,
The _time field contains an event's timestamp expressed in Unix time. This field is used to create the event timeline in Splunk Web.
You can also go through below splunk docs.
https://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/Usedefaultfields

0 Karma

nickhills
Ultra Champion

It is the time Splunk thinks the event occurred.
Not the time it was indexed.

If my comment helps, please give it a thumbs up!
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!