https://community.splunk.com/t5/Getting-Data-In/Problem-with-time-in-Edge-Processor/m-p/683812#M114149 <P>Hello,</P><P>I am receiving darktrace events through my Edge Processor as a Forwarder and I am a bit new to the SPL2 pipeline. It can probably be solved by transforming something in the pipeline.</P><P>The problem is that I am indexing events with a _time of -5h and a 2h difference from the event time stamp. Here is an example:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="adrifesa95_1-1712747276840.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/30348iB6365F27F1A0460E/image-size/medium?v=v2&amp;px=400" role="button" title="adrifesa95_1-1712747276840.png" alt="adrifesa95_1-1712747276840.png" /></span></P><P>&nbsp;</P><P>Time in the Edge Processor:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="adrifesa95_0-1712747181181.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/30347i6649A9575364B3CA/image-size/medium?v=v2&amp;px=400" role="button" title="adrifesa95_0-1712747181181.png" alt="adrifesa95_0-1712747181181.png" /></span></P><P>It should be noted that the rest of the events that I ingest through this server are arriving at the correct time.</P> Wed, 10 Apr 2024 11:08:33 GMT adrifesa95 2024-04-10T11:08:33Z https://community.splunk.com/t5/Getting-Data-In/Problem-with-time-in-Edge-Processor/m-p/683812#M114149 <P>Hello,</P><P>I am receiving darktrace events through my Edge Processor as a Forwarder and I am a bit new to the SPL2 pipeline. It can probably be solved by transforming something in the pipeline.</P><P>The problem is that I am indexing events with a _time of -5h and a 2h difference from the event time stamp. Here is an example:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="adrifesa95_1-1712747276840.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/30348iB6365F27F1A0460E/image-size/medium?v=v2&amp;px=400" role="button" title="adrifesa95_1-1712747276840.png" alt="adrifesa95_1-1712747276840.png" /></span></P><P>&nbsp;</P><P>Time in the Edge Processor:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="adrifesa95_0-1712747181181.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/30347i6649A9575364B3CA/image-size/medium?v=v2&amp;px=400" role="button" title="adrifesa95_0-1712747181181.png" alt="adrifesa95_0-1712747181181.png" /></span></P><P>It should be noted that the rest of the events that I ingest through this server are arriving at the correct time.</P> Wed, 10 Apr 2024 11:08:33 GMT https://community.splunk.com/t5/Getting-Data-In/Problem-with-time-in-Edge-Processor/m-p/683812#M114149 adrifesa95 2024-04-10T11:08:33Z https://community.splunk.com/t5/Getting-Data-In/Problem-with-time-in-Edge-Processor/m-p/683865#M114156 <P>Look at the raw text rather than the JSON to see what Splunk may be using for timestamp detection. The JSON view is sorted and Splunk will only look a certain distance into the event to detect a timestamp (128 bytes by default).</P><P>If it cannot find a timestamp, then it will use current time</P><P><A href="https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Propsconf#Timestamp_extraction_configuration" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Propsconf#Timestamp_extraction_configuration</A></P> Thu, 11 Apr 2024 00:40:38 GMT https://community.splunk.com/t5/Getting-Data-In/Problem-with-time-in-Edge-Processor/m-p/683865#M114156 bowesmana 2024-04-11T00:40:38Z https://community.splunk.com/t5/Getting-Data-In/Problem-with-time-in-Edge-Processor/m-p/683884#M114159 <P>Here the raw:<BR /><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="adrifesa95_0-1712821023278.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/30354iB6297A1408468A56/image-size/medium?v=v2&amp;px=400" role="button" title="adrifesa95_0-1712821023278.png" alt="adrifesa95_0-1712821023278.png" /></span></P><P>&nbsp;</P> Thu, 11 Apr 2024 07:37:21 GMT https://community.splunk.com/t5/Getting-Data-In/Problem-with-time-in-Edge-Processor/m-p/683884#M114159 adrifesa95 2024-04-11T07:37:21Z https://community.splunk.com/t5/Getting-Data-In/Problem-with-time-in-Edge-Processor/m-p/683981#M114169 <P>That looks like it is more than 128 characters into the event, so you should set up MAX_TIMESTAMP_LOOKAHEAD and optionally TIME_PREFIX for your sourcetype for that data.</P><P>&nbsp;</P> Thu, 11 Apr 2024 23:42:55 GMT https://community.splunk.com/t5/Getting-Data-In/Problem-with-time-in-Edge-Processor/m-p/683981#M114169 bowesmana 2024-04-11T23:42:55Z https://community.splunk.com/t5/Getting-Data-In/Problem-with-time-in-Edge-Processor/m-p/684338#M114204 <P>How can I do this? Note that the forwarder is an Edge Processor and you can't touch the conf files, everything is modified in the GUI.</P> Tue, 16 Apr 2024 08:48:06 GMT https://community.splunk.com/t5/Getting-Data-In/Problem-with-time-in-Edge-Processor/m-p/684338#M114204 adrifesa95 2024-04-16T08:48:06Z https://community.splunk.com/t5/Getting-Data-In/Problem-with-time-in-Edge-Processor/m-p/684434#M114212 <P>OK, I'm unsure where the time will get extracted, but have you looked at this document</P><P><A href="https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/EdgeProcessor/TimeExtractionPipeline" target="_blank">https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/EdgeProcessor/TimeExtractionPipeline</A></P><P>&nbsp;</P> Tue, 16 Apr 2024 23:58:29 GMT https://community.splunk.com/t5/Getting-Data-In/Problem-with-time-in-Edge-Processor/m-p/684434#M114212 bowesmana 2024-04-16T23:58:29Z https://community.splunk.com/t5/Getting-Data-In/Problem-with-time-in-Edge-Processor/m-p/684670#M114225 <P>Yes, but nothing relevant</P> Thu, 18 Apr 2024 15:11:36 GMT https://community.splunk.com/t5/Getting-Data-In/Problem-with-time-in-Edge-Processor/m-p/684670#M114225 adrifesa95 2024-04-18T15:11:36Z https://community.splunk.com/t5/Getting-Data-In/Problem-with-time-in-Edge-Processor/m-p/685099#M114305 <P>yes...</P> Tue, 23 Apr 2024 10:10:52 GMT https://community.splunk.com/t5/Getting-Data-In/Problem-with-time-in-Edge-Processor/m-p/685099#M114305 adrifesa95 2024-04-23T10:10:52Z