HEC Ingest in Splunk Cloud Classic not applying timestamp parsing

Available Languages

Updated:September 29, 2026

Document ID:SPLK046511

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud

Description

The HTTP Event Collector (HEC) receives events from sending clients in a series of HTTP requests which can be configured to /event or /raw endpoint. The difference between Event parsing and Raw event parsing is that Event parsing extracts the events from the HTTP request and parses them before sending them to indexers, when Raw event parsing accepts the request, it passes its events (extracts the fields, such as timestamps) into the pipeline.

In this scenario, when HEC data is sent to the HEC /event endpoint, the events in Splunk cloud display the events' indexed time, instead of the actual HEC data timestamp.

Investigation

1. Identify the HEC Endpoint: Determine which HTTP Event Collector (HEC) endpoint is being used to send data. It could be either /event/ or /raw/.

2. Check Configuration for /raw Endpoint: If data is being sent to the /raw endpoint, verify that the associated sourcetype for the HEC data is configured correctly. This includes settings such as TIME_FORMAT, TIME_PREFIX, and MAX_TIMESTAMP_LOOKAHEAD.

Understand Processing for /event Endpoint: If data is being sent to the /event endpoint, be aware that the data bypasses regexing for time extraction and event breaking. Splunk Cloud extracts the timestamp from the data source according to the following rules:If the auto_extract_timestamp argument is set to true in the /event URL, timestamped events are sent to the HEC using the Splunk platform JSON event protocol.
An example of a timestamp is 2024-05-20 00:00:00.
If there’s a timestamp in the event’s JSON envelope, Splunk honors that timestamp first.
If there’s no timestamp in the event’s JSON envelope, the merging pipeline extracts the timestamp from the event.
If time=xxx is used in the /event URL, then auto_extract_timestamp is disabled.

From: HEC REST Endpoints