Answer :
- MAX TIME STAMP LOOKAHEAD = 10
Explanation :
When you use TIME_PREFIX, the nature of MAX_TIMESTAMP_LOOKAHEAD changes: instead of counting from the beginning of the raw event text, it will count from the position AFTER the TIME_PREFIX. So by using TIME_PREFIX, you pretty much guarantee that Splunk wi