topic Re: _JSON sourcetype indexing data - timestamp recognition in Getting Data In

_JSON sourcetype indexing data - timestamp recognition

himynamesdave — Thu, 26 Mar 2015 14:10:31 GMT

Hi all,

I am attempting to index a .json formatted file. Using the Splunk data checker, the fields are all extracted nicely using _JSON sourcetype (well done Splunk).

In my events there is a field named, "field.timestamp", that contains an epoch timestamp (13 digits) i want to use for the timestamp (no timestamp is recognised by default).

Here's a raw event:

{"field":{"timestamp":"1429306200000"}}

If I specify the field "field.timestamp" to Splunk as the field where the timestamp resides it still does not recognise any timestamp.

What would be a good way to extract this timestamp?

Re: _JSON sourcetype indexing data - timestamp recognition

himynamesdave — Thu, 26 Mar 2015 17:31:04 GMT

I have also tried setting "TIME_FORMAT = %s%3N" (13 digit epoch millisecond) which also fails

Re: _JSON sourcetype indexing data - timestamp recognition

aaronkorn — Thu, 26 Mar 2015 20:31:04 GMT

The settings actually work. If you noticed, your timestamp is in the future...

1429306200000 equates to Fri, 17 Apr 2015 21:30:00 GMT

Re: _JSON sourcetype indexing data - timestamp recognition

himynamesdave — Thu, 26 Mar 2015 20:33:06 GMT

i'm an idiot - thankyou!