topic Re: How to recognize event time that is embedded in json string in epoch seconds? in Getting Data In

How to recognize event time that is embedded in json string in epoch seconds?

skericsson — Mon, 28 Sep 2020 09:47:59 GMT

I'm using "From files and directories" --> "Upload and index a file" to feed the data file. The file has data in following format.

{ "_id": { "$oid": "4b97ca22729772ec85d48fc0"}, "subscriberId": "C10000235", "createTime": 1268238882453, "serviceGroup": "SGID0001", "sessionProtocolIndicator": null, "networkProxyId": "PROXY_001" }

Search shows the following basic information:
host=srinidev sourcetype=sds3 source=sds3.out

How can I get splunk (using 4.2.3) to recognize 1268238882453 as the date and use it as event time?

I added a $SPLUNK_HOME/etc/local/props.conf file with these lines:

[sds3]

TIME_PREFIX = createTime

TIME_FORMAT = %s

I also added $SPLUNK_HOME/etc/apps/search/input.conf, but with not much success.

Any help is greatly appreciated. Thanks.

Re: How to recognize event time that is embedded in json string in epoch seconds?

gkanapathy — Fri, 12 Aug 2011 20:22:56 GMT

That is basically right, but first, is this all on a single Splunk instance (no forwarder)? You should try:

TIME_PREFIX = \"createTime\"\:
TIME_FORMAT = %10s%3N
MAX_TIMESTAMP_LOOKAHEAD = 15

instead of what you have above. I think the TIME_PREFIX you have should work anyway, but that the TIME_FORMAT might not be taking because %s is expecting epoch seconds, and your timestamp is milliseconds, which puts the date about 40,000 years in the future, which is outside of Splunk's default sanity limit. You might want to also try %s%3N for your TIME_FORMAT if the above doesn't work, or if you have dates either before Sep 8 2001 (9 digits) or dates after 2286.

Re: How to recognize event time that is embedded in json string in epoch seconds?

skericsson — Sat, 13 Aug 2011 13:19:12 GMT

Thanks. Still having trouble. So is etc/apps/search/input.conf necessary. I added following lines to that file.

[monitor:///home/test/data/session_data.out]

sourcetype = sds3