Practical Splunk Search Processing Language: A Guide for Mastering SPL Commands for Maximum Efficiency and Outcome

© Karun Subramanian 2020

K. SubramanianPractical Splunk Search Processing Languagehttps://doi.org/10.1007/978-1-4842-6276-4_3

3. Using Time-Related Operations

Karun Subramanian¹  

(1)

Greater Minneapolis, MN, USA

 

Splunk is optimized for indexing time-series data. In this context, one could say that Splunk is a time-series database, even though it does much more than that. When Splunk indexes an event, it expects to retrieve the timestamp from the event and store it as a field along with the raw data. Even if the raw event does not contain the timestamp, Splunk will assign one at index time using various approximations, such as the time at which the event was indexed, the last modification time of the source file, the timestamp of the previous event, ...