Adding older log data with epoch timestamps, however, Time always matches Receipt Time

Comments

1 comment

  • Avatar
    Kevin Keech

    Hi Aric,

    Sumo Logic assumes that all log messages coming from a particular Source will have timestamps that are within a window of -1 year through +2 days compared to the current time. Any log message with a parsed timestamp outside of that window is automatically re-stamped with the current receipt time.

    See the following help for more information on ingesting historical data

    0
    Comment actions Permalink

Please sign in to leave a comment.