topic Re: How to set custom user provided timestamp as the Splunk timestamp while logging to Splunk? in Getting Data In

How to set custom user provided timestamp as the Splunk timestamp while logging to Splunk?

abhishek_singh — Mon, 03 Apr 2023 19:57:58 GMT

I have a use case in which our user sends us logs in batches in which each individual logs have their own timestamp(when they would have occurred), which we then log individually to the splunk using serilog.sinks.splunk in .net 6.

What we are trying to do is replace the automatically generated logging time in splunk with the original timestamp that we received from our user.

Is this possible in splunk ? and if so then how.

Re: How to set custom user provided timestamp as the Splunk timestamp while logging to Splunk?

richgalloway — Tue, 04 Apr 2023 13:38:06 GMT

Between reading data from the source and writing it to Splunk using serilog.sinks.splunk, you can do anything you want, including replacing the event timestamp.

Be sure the Splunk sourcetype for the data has settings to properly find and interpret the new timestamp. (Don't use DATETIME_CONFIG = current, for example).

Re: How to set custom user provided timestamp as the Splunk timestamp while logging to Splunk?

abhishek_singh — Tue, 04 Apr 2023 13:47:53 GMT

@richgalloway : My apologies if this is a trivial question i am quite new to splunk. Where is this setting for DATETIME_CONFIG present and how can we edit it. Can we do this on the fly using the serilog.sinks.splunk.

Re: How to set custom user provided timestamp as the Splunk timestamp while logging to Splunk?

richgalloway — Tue, 04 Apr 2023 15:56:16 GMT

DATETIME_CONFIG is one of many settings available in props.conf files on your indexers and heavy forwarders (if any). It's unlikely it can be set using serilog.sinks.splunk.

See https://docs.splunk.com/Documentation/Splunk/9.0.4/Admin/Propsconf#:~:text=Timestamp%20extraction%20configuration-,DATETIME_CONFIG,-%3D%20%5B%3Cfilename%20relative%20to

Re: How to set custom user provided timestamp as the Splunk timestamp while logging to Splunk?

woodcock — Tue, 11 Apr 2023 20:24:53 GMT

Create a props.conf on your indexers to do the Magic8:
https://kinneygroup.com/blog/splunk-magic-8-props-conf/