time indexing not correct

splunksurekha — Tue, 29 Sep 2020 07:46:42 GMT

Hi attached is the image which shows there is a difference in the Time field and the actual time which comes from the input file getting indexed with column name alertdate.
so that means the index time and alertdate are not in sync which is incorrect right . Can you help me here.

I am using below configuration.
props.conf
[zbxAlertReport]
SHOULD_LINEMERGE = false
INDEXED_EXTRACTIONS = csv
FIELD_DELIMITER = ,
FIELD_NAMES = alerthost,hostname,alertname,alertstatus,alertseverity,alertdate
TIMESTAMP_FIELDS = date
TIME_FORMAT = %a%b%d%H:%M:%S%Y
category = Structured
MAX_TIMESTAMP_LOOKAHEAD = 500

transforms.conf
[zbxAlertReport]
filename = ZbxDailyReport.csv

Re: time indexing not correct

richgalloway — Tue, 29 Sep 2020 07:49:25 GMT

Splunk isn't finding a timestamp that matches the specified criteria so it's using current time. Making the following changes should fix it.

The TIMESTAMP_FIELDS value is "date", but there is no such field in the event. Perhaps it should be "alertdate".
The TIME_FORMAT value looks like it doesn't match the data in the alertdate field. Try TIME_FORMAT = %a %b %d %H:%M:%S %Y.

topic time indexing not correct in Deployment Architecture

time indexing not correct

Re: time indexing not correct