topic Re: change timeformat in props.conf for a specific sourcetype in Getting Data In

How to change timeformat in props.conf for a specific sourcetype?

Simone — Thu, 17 Aug 2023 18:05:17 GMT

Hi all,

i want to change the timestamp on event:

Simone_0-1692262979119.png

I want put the createDteTime on Time (yellow)

I changed the props.conf as follow:

[sourcetype] INDEXED_EXTRACTIONS = json TIMESTAMP_FIELDS = createdDateTime\": TIME_FORMAT = %FT%TZ

But at the moment does not work.

Any idea?

Thanks!

Re: change timeformat in props.conf for a specific sourcetype

PickleRick — Thu, 17 Aug 2023 09:18:13 GMT

1. Why are you using INDEXED_EXTRACTIONS? Why is KV_MODE=json not enough?

2. Where do you have your props.conf?

3. Your field is called createdDateTime, not createdDateTime":

Re: change timeformat in props.conf for a specific sourcetype

Simone — Thu, 17 Aug 2023 09:27:30 GMT

Since it doesn't work without it, I tried adding INDEXED_EXTRACTIONS
etc\system\default
i tried both, it doesn't work

Thanks

Re: change timeformat in props.conf for a specific sourcetype

gcusello — Thu, 17 Aug 2023 09:32:26 GMT

Hi @Simone ,

did you tried:

[sourcetype] INDEXED_EXTRACTIONS = json TIMESTAMP_FIELDS = createdDateTime TIME_PREFIX =createdDateTime:\s+ TIME_FORMAT = %Y-%m-%dT%H:%M:%SZ

Ciao.

Giuseppe

Re: change timeformat in props.conf for a specific sourcetype

Simone — Thu, 17 Aug 2023 10:20:44 GMT

Hi Giuseppe,

unfortunately doesn't work. The raw is the following: "createdDateTime": "2023-08-17T10:10:59Z"

i don't know if i have to change the regex

Re: change timeformat in props.conf for a specific sourcetype

PickleRick — Thu, 17 Aug 2023 10:42:18 GMT

1. Indexed extractions are not something that should be used lightly. Unless you have a very good use case for it, you should stick to search-time extractions (aka KV_MODE=json in this case).

2a. You should _never_ touch the */default/* files! (unless you're making your own app and providing the default config for it). Your overwrites should go to the local directory.

2b. But on which component did you put those settings?

Did you adjust any other settings regarding this sourcetype? What does the btool say? (splunk btool props list <your_sourcetype> --debug)

Re: change timeformat in props.conf for a specific sourcetype

Simone — Thu, 17 Aug 2023 11:17:08 GMT

You right! i have change the value directly on the app's props.conf reported the correct field and now it works.

Thanks!

Re: change timeformat in props.conf for a specific sourcetype

gcusello — Thu, 17 Aug 2023 20:59:49 GMT

Hi @Simone,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉