https://community.splunk.com/t5/Getting-Data-In/json-in-splunk-is-ignoring-the-timestamp/m-p/57574#M11248 <P>Hi I currently have the following json in splunk:</P> <PRE><CODE>{"first_name": "john", "last_name": "black", "timestamp": "2013-09-09 08:00:00", "age": "26", "activity": "start"} </CODE></PRE> <P>The issue is that splunk should read the timestamp and use that for the time the event is logged. However, it simply is taking the time the event was indexed into the system instead. There is no problem with the other fields, they are parsed fine by splunk.</P> <P>How should I make splunk recognise the timestamp in this json? Is it possible for it to be done automatically if the format the timestamp is written in it changed?</P> <P>Anthony</P> Mon, 09 Sep 2013 10:36:56 GMT anthonycopus 2013-09-09T10:36:56Z https://community.splunk.com/t5/Getting-Data-In/json-in-splunk-is-ignoring-the-timestamp/m-p/57574#M11248 <P>Hi I currently have the following json in splunk:</P> <PRE><CODE>{"first_name": "john", "last_name": "black", "timestamp": "2013-09-09 08:00:00", "age": "26", "activity": "start"} </CODE></PRE> <P>The issue is that splunk should read the timestamp and use that for the time the event is logged. However, it simply is taking the time the event was indexed into the system instead. There is no problem with the other fields, they are parsed fine by splunk.</P> <P>How should I make splunk recognise the timestamp in this json? Is it possible for it to be done automatically if the format the timestamp is written in it changed?</P> <P>Anthony</P> Mon, 09 Sep 2013 10:36:56 GMT https://community.splunk.com/t5/Getting-Data-In/json-in-splunk-is-ignoring-the-timestamp/m-p/57574#M11248 anthonycopus 2013-09-09T10:36:56Z https://community.splunk.com/t5/Getting-Data-In/json-in-splunk-is-ignoring-the-timestamp/m-p/57575#M11249 <P>See <A href="http://answers.splunk.com/answers/104500/transforming-timestamps">http://answers.splunk.com/answers/104500/transforming-timestamps</A> <BR /> Might help</P> Sun, 06 Oct 2013 08:14:25 GMT https://community.splunk.com/t5/Getting-Data-In/json-in-splunk-is-ignoring-the-timestamp/m-p/57575#M11249 amanteja 2013-10-06T08:14:25Z