product
service
- Simple Security Consulting [Consulting]
- Splunk SOAR Automation Assessment Service [Consulting]
- Dashboard/SPL Creation Pack [Implementation/Building Support]
- Version upgrade service [implementation and construction support]
- Splunk Premium Apps construction support service [implementation and construction support]
- Splunk Security Log Analysis Start Package [Original App/Service]
- Splunk × CrowdStrike Falcon Insight, Macnica Original App [Original App/Service]
- Government uniform standard compatible App [Original App/Service]
- Smart Security Monitoring App [Original App/Service]
- Splunk × LANSCOPE Original App [Original App/Service]
- Security Monitoring App for Box [Original App/Service]
- Cloud Security Monitoring App [Original App/Service]
- SIEM Operation Monitoring Service [Original App/Service]
- List of services
- Macnica Premium Support for Splunk (utilization support, version upgrade monitoring)
- Macnica Premium Support for Splunk Skill Up Package
Specifications/Technical Information
Application for evaluation machine
- FAQ
The order in which timestamps are recognized
- release date
- 2018-06-18
- last updated
- 2024-01-11
- version
- Splunk Enterprise 9.0.0
- Overview
- Explains the order and specifications for recognizing timestamps.
- Reference information
-
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Data/HowSplunkextractstimestamps
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Data/Configurepositionaltimestampextraction
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Data/Configuretimestamprecognition
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Data/Configuredatetimexml
- content
-
Order and specifications for recognizing timestamps
Splunk tries to recognize timestamps in the following order:
- When there is date and time information in the event
①If “TIME_FORMAT” is specified in props.conf, the specified “TIME_FORMAT” will be used to find the timestamp within the event.
②If "TIME_FORMAT" is not specified in props.conf, an attempt will be made to recognize the timestamp from within the event.
- If there is no date and time information in the event
Attempts to recognize the most recent timestamp fetched from the same source.
- If the source does not contain date and time information
Splunk will attempt to recognize timestamps from source and file names.
- If there is no date and time information in the file name
It tries to recognize the last modified time of the file as a timestamp.
- I try to use datetime.xml to recognise the timestamp from the event.
- If the timestamp cannot be recognized even in 1-5 above
Recognizes the system time of the Splunk server as a timestamp.
(Captured time = timestamp of the event)that's all
In charge of Macnica Splunk Co., Ltd.
- TEL：045-476-2010
- E-mail：splunk-sales@macnica.co.jp
Mon-Fri 8:45-17:30
