scripted input timestamp extraction

aaronkorn — Tue, 11 Jun 2013 14:03:07 GMT

We have a script that executes every 5 minutes to pull back server stats but it takes about 2-3 minutes to execute so the timestamp of events is different. Is it possible to give all these events that come in during the scripted input execution the timestamp of when the script was executed?

Re: scripted input timestamp extraction

MHibbin — Tue, 11 Jun 2013 15:40:38 GMT

Hi,

You need to configure your props.conf file for this. Please see the following extract from the documentation:

#******************************************************************************
# Timestamp extraction configuration
#******************************************************************************

DATETIME_CONFIG = <filename relative to $SPLUNK_HOME>
* Specifies which file configures the timestamp extractor, which identifies timestamps from the
  event text.
* This configuration may also be set to "NONE" to prevent the timestamp extractor from running
  or "CURRENT" to assign the current system time to each event.
  * "CURRENT" will set the time of the event to the time that the event was merged from lines, or
    worded differently, the time it passed through the aggregator processor.
  * "NONE" will leave the event time set to whatever time was selected by the input layer
    * For data sent by splunk forwarders over the splunk protocol, the input layer will be the time
      that was selected on the forwarder by its input behavior (as below).
    * For file-based inputs (monitor, batch) the time chosen will be the modification timestamp on
      the file being read.
    * For other inputs, the time chosen will be the current system time when the event is read from
      the pipe/socket/etc.
  * Both "CURRENT" and "NONE" explicitly disable the per-text timestamp identification, so
    the default event boundary detection (BREAK_ONLY_BEFORE_DATE = true) is likely to not work as
    desired.  When using these settings, use SHOULD_LINEMERGE and/or the BREAK_ONLY_* , MUST_BREAK_*
    settings to control event merging.
* Defaults to /etc/datetime.xml (for example, $SPLUNK_HOME/etc/datetime.xml).

Ref: http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Propsconf

Hope this helps.

topic Re: scripted input timestamp extraction in Getting Data In

scripted input timestamp extraction

Re: scripted input timestamp extraction