topic Re: Splunk SDK: Is there a way to set the time of an event created from Submit? in Getting Data In

Splunk SDK: Is there a way to set the time of an event created from Submit?

ConnorG — Wed, 03 Sep 2014 18:22:22 GMT

I'm currently in the process of sending data to the Splunk server through the C# SDK.

The time for every event sent to the server is based on when the server received the event, and not my own timestamp that is attached to the event in a field.

Here's an example of what I'm doing:

        Receiver splunkReceiver = new Receiver(service);

        var args = new Args();
        args.Add("host", "win-5ja2nu0k88c");
        args.Add("source", "dynaTrace");
        args.Add("sourcetype", "Monitoring");

        splunkReceiver.Submit("main", args, "EventType=4 Keywords=Classic, RecordNumber=number, timestamp = 9/04/13");

Is there a way to set set the time of the event created from this Submit? I would want it to be equal to my timestamp field. Perhaps through a specific arg?

Re: Splunk SDK: Is there a way to set the time of an event created from Submit?

Damien_Dallimor — Thu, 04 Sep 2014 00:55:39 GMT

I tried reformatting your message a bit and it works :

Thu Sep 04 2013 12:47:31 EventType=4 Keywords=Classic RecordNumber=number

Alternatively , you could declare timestamp extraction rules in props.conf for your sourcetype "Monitoring"

Re: Splunk SDK: Is there a way to set the time of an event created from Submit?

ConnorG — Thu, 04 Sep 2014 14:58:31 GMT

That worked wonderfully. Thanks much for the assistance sir.

Re: Splunk SDK: Is there a way to set the time of an event created from Submit?

Damien_Dallimor — Thu, 04 Sep 2014 18:14:05 GMT

Please "accept" the answer. Thanks.