Time is an important and confusing topic in Splunk. If you want to skip this section, absorb one concept: time must be parsed properly on the way into the index, as it cannot be changed later without indexing the raw data again.
Time is an important and confusing topic in Splunk. If you want to skip this section, absorb one concept: time must be parsed properly on the way into the index, as it cannot be changed later without indexing the raw data again.