The addition of the punct field to a sourcetype is a default configuration within Splunk and it is sometimes useful for highlighting events with outlying patterns within searches (and therefore useful for seeing unusual – and maybe dangerous/illegal activity) however, it is rarely used and can be generated at search time in searches that may need it.Īs generating the punct field is an extra piece of processing that Splunk will not need to do and as the field is added to the index of your data which you may never need, if you switch it off, then you will reduce: There is another optimization that Splunk taught me about the “punct” field. We can reduce the amount of work that Splunk needs to do drastically and therefore give it more time for other tasks, such as searching, reporting, alerting and dashboarding by applying the Splunk Best Practices below. So the case for configuring our timestamps is pretty strong. – All of this extra work can clog up a Heavy Forwarder or Indexer in the Aggregator Pipeline. – Incorrect timestamps can result in data being aged out prematurely or retained for too long. – The time zone may be wrong (and therefore the event time may be recorded incorrectly). – Running over 30 different REGEX pattern searches FOR EACH EVENT is a LOT of work! – The date may be in a different format than Splunk thinks that it is (such as the Month/Day being switched), although there are some clever checks it does before validating this. – The first timestamp that is in the data may not be the one that is needed. – The timestamp might not be in the first 128 characters of the event. There are a few issues with this behaviour:

– Splunk uses over 30 different REGEX patterns to search the event for a suitable timestamp that it can use. – Splunk uses the first timestamp that it finds in the event. – Splunk looks at the first 128 characters in an event for the timestamp. Several things of note about this generic process: Splunk is pretty clever about finding time stamps for its events (because, well, without a timestamp, Splunk cannot organise the data) and so, when it has separated the data into events, it searches each event to find a timestamp. The other great performance boost that we can apply to Splunk data onboarding is telling Splunk about how the timestamps are to be found.

Splunk server.conf