topic Re: How to extract timestamp for JSON events with no date/time? in Getting Data In

How to extract timestamp for JSON events with no date/time?

jwalzerpitt — Tue, 18 Oct 2022 13:09:03 GMT

I have a flat file that is in JSON format where events have no date/time as follows:

{"device": "info.gw.xyz.com", "ip": "x.x.x.x", "age": "0", "mac": "Incomplete", "interface": " "}, {"device": "info.gw.xyz.com", "ip": "x.x.x.x", "age": "-", "mac": "0000.0000.0000", "interface": "Vlan673"}

My props.conf file is as follows:

[my_arp] INDEXED_EXTRACTIONS = JSON TZ=UTC

Problem is when I search events, they are four hours in the future.

The files are on a sever that has the UF and that has the correct time set so looking through the Splunk docs (https://docs.splunk.com/Documentation/Splunk/9.0.1/Data/HowSplunkextractstimestamps) I see this:

If no events in the source have a date, Splunk software tries to find a date in the source name or file name. The events must have a time, even if they don't have a date.

The files do have a date and time

How do I fix this?

Thx

Re: How to extract timestamp for JSON events with no date/time?

jwalzerpitt — Tue, 18 Oct 2022 13:13:00 GMT

So just checked preferences for my account in Splunk Cloud and no default was set so I changed that to GMT/Eastern Time and now when I search the events they have the correct time.

Just making sure this is the fix

Re: How to extract timestamp for JSON events with no date/time?

jwalzerpitt — Mon, 24 Oct 2022 13:32:20 GMT

Verified with Splunk support that setting the time zone in props in combination with setting time zone preference in GUI is correct

Re: How to extract timestamp for JSON events with no date/time?

somesoni2 — Mon, 24 Oct 2022 13:36:33 GMT

Yes. The data is being logged in GMT/UTC as you specified in props.conf. The _time (or Time column) in search result is translated event time based on current user's timezone (so if you're TZ before UTC, events will show in future). If you want to see the time in the same timezone where they occurred, then what you did is correct (changing your timezone to match data timezone).