topic Re: Timestamp preview different than timestamp in search for my json in Getting Data In

Timestamp preview different than timestamp in search for my json

hvaithia — Mon, 28 Sep 2020 19:47:37 GMT

here is my props.conf

[json_no_timestamp_new]
INDEXED_EXTRACTIONS = json
KV_MODE = json
TIMESTAMP_FIELDS = timestamp
TIME_FORMAT = %s%3N
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 512
description = JavaScript Object Notation
category = Structured
disabled = false
pulldown_type = true

I tried to attached the preview from splunk and data coming from splunk forwarder but I am not able to do so...

Re: Timestamp preview different than timestamp in search for my json

hvaithia — Mon, 28 Sep 2020 19:47:39 GMT

The event starts with {"building":
Sample event below
{"building": false, "changeSet": {"items": [], "kind": null}, "builtOn": "rhel6", "description": null, "artifacts": [], "timestamp": 1430241584496, "number": 13, "actions": [{"causes": [{"upstreamBuild": 14, "shortDescription": "Started by upstream project \"answers\" build number 14", "upstreamProject": "answers", "upstreamUrl": "job/answers/"}]}, {}, {}, {}, {}, {"highlightsData": "[{\"Previous Job\":\"answers#14\"},{\"Previous Job\":\"answers_se\"},{\"Build host\":\"rhel6\"}]", "highlightsTable": "<h4>Global Patterns</h4>Previous Job:Started by <a href="/hudson/job/answers/14/">answers</a>Previous Job:Started by <a href="/hudson/job/answers/8/">answers #8</a>Build host:Built on <a href="/hudson/computer/rhel6/">rhel6</a>"}], "id": "2015-04-28_17-19-44", "keepLog": false, "url": "http://thefactory.xyz.com:9999/jenkins/job/answers/13/", "culprits": [], "result": "SUCCESS", "executor": null, "duration": 377658, "fullDisplayName": "answers", "estimatedDuration": 298415}

Re: Timestamp preview different than timestamp in search for my json

hvaithia — Mon, 28 Sep 2020 19:55:27 GMT

[json_timestamp]
INDEXED_EXTRACTIONS = json
TIME_FORMAT = %s%3N

TIMESTAMP_FIELDS = timestamp

TIME_PREFIX = timestamp
SHOULD_LINEMERGE = false
description = JavaScript Object Notation
category = Structured
disabled = false
pulldown_type = true

This is the props that worked out for me finally if anyone is interested in the future. TIMESTAMP_FIELDS didn't unfortunately work with the forwarder (although it worked in the data preview)