Warning
Splunkbase Classic has been deprecated and will be deactivated on February 18, 2026.
Warning

This app is archived. App archiving documentation

ISO8601 Segmenter Configuration app icon

ISO8601 Segmenter Configuration

This add-on will configure Splunk to not consider an ISO8601 timestamp when generating the index. It will save significant disk space at the cost of not being able to search free text on timestamps. i.e. it's no longer possible to search for terms like '2018'. Normal search by time of course still works.

Built by
splunk product badge

Latest Version 1.0
July 23, 2018
Compatibility
Splunk Enterprise
Platform Version: 9.4, 9.3, 9.2, 9.1, 9.0, 8.2, 8.1, 8.0, 7.3, 7.2, 7.1, 7.0
Rating

0

(0)

Log in to rate this app
Support
ISO8601 Segmenter Configuration support icon
Not Supported
Ranking

#36

in Generic
This add-on will configure Splunk to not consider an ISO8601 timestamp when generating the index. It will save significant disk space at the cost of not being able to search free text on timestamps. i.e. it's no longer possible to search for terms like '2018'. Normal search by time of course still works. This app will not work in Splunk Cloud. It modifies the `segmenters.conf` and this only supported in on-premises deployments.

Categories

Generic, Utilities

Created By

Michel Oosterhof

Type

addon

Downloads

401

Resources

Log in to report this app listing