Latest Version 1.0
July 23, 2018
Welcome to the new Splunkbase! To return to the old Splunkbase, click here.
This app is archived. Learn more
ISO8601 Segmenter Configuration
This add-on will configure Splunk to not consider an ISO8601 timestamp when generating the index. It will save significant disk space at the cost of not being able to search free text on timestamps. i.e. it's no longer possible to search for terms like '2018'. Normal search by time of course still works.
Built by Michel Oosterhof
Compatibility
Not Available
Platform Version: 9.4, 9.3, 9.2, 9.1, 9.0, 8.2, 8.1, 8.0, 7.3, 7.2, 7.1, 7.0
Rating
0
(0)
Log in to rate this app
Support
Not Supported
Ranking
#34
in Generic
This add-on will configure Splunk to not consider an ISO8601 timestamp when generating the index. It will save significant disk space at the cost of not being able to search free text on timestamps.
i.e. it's no longer possible to search for terms like '2018'. Normal search by time of course still works.
This app will not work in Splunk Cloud. It modifies the `segmenters.conf` and this only supported in on-premises deployments.
Categories
Created By
Michel Oosterhof
Type
addon
Downloads
395
Licensing
Splunk Answers
Resources
Log in to report this app listing