At index time, in which field does Splunk store the timestamp value?

During the indexing process, Splunk extracts a timestamp from the raw event data. This extracted value is then normalized into UNIX epoch time and stored in the default internal field named time. This field is fundamental for organizing, searching, and correlating data chronologically within the Splunk platform. The leading underscore signifies that time is an internal field automatically generated by Splunk.

A. time: This is not the default internal field used by Splunk for event timestamps. While it can be a user-defined field, it is not the primary, indexed time field.

C. EventTime: This is not a standard default field in Splunk. It might be extracted as a custom field, but it is not the internal timestamp field.

D. timestamp: While a descriptive name, Splunk's specific, default internal field for the event's time is time, not timestamp.

1. Splunk Enterprise Documentation

Search Manual

"About default fields":

"Splunk software adds several fields to events at index time. These fields are the default fields... The time field is the event timestamp. This is an internal field." (Version 9.2.1

Section: Use default fields)

2. Splunk Enterprise Documentation

Getting Data In

"How timestamp assignment works":

"During the input phase

the Splunk platform gives each event a preliminary timestamp value. It stores this value in the time field... Splunk software stores timestamps in the time field in Coordinated Universal Time (UTC) format." (Version 9.2.1

Chapter: Configure event processing

Section: Configure timestamp recognition)

3. Splunk Enterprise Documentation

Search Reference

"Default fields":

"The following is a list of the fields that are added to events at index time... time: The timestamp of the event

stored in UNIX time." (Version 9.2.1

Chapter: About fields

Section: Default fields)