Fundamentals

Auto Timestamp in Cribl Stream

Timestamp source and adjustment, configured the way the function page describes.

October 29, 2026
6 min read

What the function does

The Auto Timestamp Function page in the Cribl Stream documentation describes a Function that extracts time to a destination field, given a source field in the event. By default, Auto Timestamp makes a first best effort and populates _time. The Function allows fine-grained and powerful transformations to populate new time fields, or to edit existing time fields.

You can use the Function's Additional timestamps section to create custom time fields using regex and custom JavaScript strptime functions. The page also notes that the Auto Timestamp Function uses the same basic algorithm as the Event Breakers timestamp settings and the C.Time.timestampFinder() native method.

One scoping note about samples: when you add a sample (via paste or a local file), the page says you should accomplish time and event breaking at the same time you add the data.

How it is configured

The Usage section of the page lists the Function's settings with their documented defaults.

Additional timestamps extracts additional timestamp formats. Select Add Timestamp to define each format, and each row provides two fields. Regex is a regex with the first capturing group matching the timestamp; you can type in a pattern, or use one of the predefined Regexes from the regex library. Strptime format selects or enters the strptime format for the captured timestamp.

Under Advanced Settings, Time expression is the expression with which to format extracted time. Current time, as a JavaScript Date object, is in the global time. The setting defaults to time.getTime() / 1000, and you can access other fields' values via __e.<fieldName>. Start scan offset is how far into the string to look for a time string. Max timestamp scan depth is the maximum string length at which to look for a timestamp. Default time decides how to set the time field if no timestamp is found, and defaults to Current time.

Two fields enable you to constrain (clamp) the parsed timestamp, to prevent the Function from mistakenly extracting non-time values as unrealistic timestamps. Earliest timestamp allowed is a string relative to now, with sample value -42years and default value -420weeks; parsed values earlier than this date will be set to the Default time. Future timestamp allowed is a string relative to now, with sample value +42days and default value +1week; parsed values after this date will be set to the Default time.

The page's Format Reference section references the d3-time-format locale format, and notes that directives annotated with a (†) symbol might be affected by the locale definition.

Example from the page

The page's Basic Example creates a Pipeline with one Auto Timestamp Function and leaves the settings of the Function to their defaults. The sample event is copied from the Auto Timestamp Function page:

Jan 20 12:03:55 PA-VM 1,2025/01/20 13:03:58,CRIBL,TRAFFIC,end,2049,2024/09/20 14:03:58,314.817.108.226,10.0.0.102,314.817.108.226,10.0.2.65,cribl,,,incomplete,vsys1,untrusted,trusted,ethernet1/3,ethernet1/2,log-forwarding-default,2024/09/20 13:03:58,574326,1,53722,8088,53722,8088,0x400064,tcp,allow,296,296,0,4,2024/09/20 13:03:45,7,any,0,730277,0x0,United States,10.0.0.0-10.255.255.255,0,4,0,aged-out,0,0,0,0,,PA-VM,from-policy,,,0,,0,,N/A,0,0,0,0

To add this sample, the page has you go to Sample Data > Import Data in the Pipeline page and paste the data snippet. Do not make any changes to timestamping or line breaking, and select Save as Sample File. By default, Cribl Stream will inspect the first 150 characters and will extract the first valid timestamp it sees; you can modify this character limit under Advanced Settings > Max timestamp scan depth.

Cribl Stream will grab the first part of the event and will settle on the first matching value to display for time. The value the page displays, copied from the Auto Timestamp Function page:

_time: 1737374635

The same example reports the result as GMT: Jan 20, 2025 12:03:55 PM GMT, and Your Local Time: Jan 20, 2025 1:03:55 PM GMT+01:00. Because no explicit timezone has been set under Default timezone, _time inherits the Local timezone, which in the example is GMT +01:00.

The page then moves to an Advanced Settings Example: the datetime.strptime() method creates a datetime object from the string passed in by the Regex field, and the example uses it to match a timestamp in AM/PM format at the end of a line. The sample, copied from the Auto Timestamp Function page:

This is a sample event that will push the datetime values further on inside the event. This is still a sample event and finally here is the datetime information!: Server_UTC_Timestamp="04/27/2020 2:30:15 PM"

The example sets Max timestamp scan depth to 210, then clicks to add Additional timestamps and enters the values copied from the Auto Timestamp Function page:

Regex: (\d{1,2}\/\d{2}\/\d{4}\s\d{1,2}:\d{2}:\d{2}\s\w{2})
Strptime format: '%m/%d/%Y %H:%M:%S %p'

What the docs flag

On format acceptance, the page's Complying with the Format section says that in order to use auto timestamping upon ingestion, the formatting used must match the %Z parameters in the Format Reference. As its example of what the Function will automatically parse, the page lists these formats, copied from the Auto Timestamp Function page:

2020/06/10T17:17:35.004-0700
2020/06/10T17:17:35.004-07:00
2020/06/10T17:17:35.004-07
2020/06/10T10:17:35.004Z
2020/06/10T11:17:35.004 EST

To parse other formats, the page points to the Additional Timestamps section's internal Regex or Strptime Format operators.

The page's Gnarly Details box adds two resolution notes: the Function supports the %f (microseconds) directive, and Cribl Stream will truncate timestamps to three-digit (milliseconds) resolution, omitting trailing zeros.

Timezone handling carries its own note: Cribl Stream uses ICU for timezone information, does not query external files or the operating system, and the bundled ICU is updated periodically. For additional timezone details, the page links to the IANA time zones site.

Finally, remember the clamp behavior described under Advanced Settings: a parsed value that falls outside the Earliest timestamp allowed or Future timestamp allowed strings is set to the Default time, not kept as parsed.

Frequently asked questions

What does the Auto Timestamp Function in Cribl Stream do by default?

It extracts time to a destination field, given a source field in the event, and by default makes a first best effort and populates _time. It uses the same basic algorithm as the Event Breakers timestamp settings and the C.Time.timestampFinder() native method.

Which fields does the Auto Timestamp Function in Cribl Stream read and write?

Source field is the field to search for a timestamp, and it defaults to _raw. Destination field is the field to place the extracted timestamp in, defaults to _time, and supports nested addressing.

What does the Auto Timestamp Function in Cribl Stream do if it finds no timestamp?

The Default time setting decides how to set the time field if no timestamp is found, and it defaults to Current time. The same Default time applies when a parsed value falls earlier than Earliest timestamp allowed, or later than Future timestamp allowed.

How does the Auto Timestamp Function in Cribl Stream handle formats that don't match %Z?

Using auto timestamping upon ingestion requires the formatting to match the %Z parameters in the Format Reference. To parse other formats, the page points to the Additional Timestamps section's internal Regex or Strptime Format operators.

Source

Verified against Cribl Stream 4.20 documentation on October 29, 2026.