https://community.splunk.com/t5/Getting-Data-In/JSON-time-not-always-extracted/m-p/191264#M38068 <P>Either setting MAX_TIMESTAMP_LOOKAHEAD = 0 or ensuring timestamp field is always the first field of the JSON document sorted my issue. </P> Mon, 28 Sep 2020 18:03:50 GMT jeanmatthieu 2020-09-28T18:03:50Z https://community.splunk.com/t5/Getting-Data-In/JSON-time-not-always-extracted/m-p/191263#M38067 <P>Hi,</P> <P>I'm running Splunk 6.1.4 and I send JSON documents through a TCP port.<BR /> I have a JSON document as follow and no specific TZ settings in my props.conf</P> <PRE><CODE>{ // ... "_time":"2014-11-01T02:17:34.712Z", // ... } </CODE></PRE> <P>Sometimes, the _time field within the document is used as the Time of the event. <BR /> Other times, _time is transformed to a regular time field and another (random) Time fields is used. </P> <P>Using the above example it is not uncommon to see Time set to 11/01/14 02:17:34.000 <BR /> <STRONG>but</STRONG> I also encountered the weirdest date such as 10/09/06 12:00:00.000.</P> <P>Any idea what might be up please?<BR /> Thanks!</P> Sat, 01 Nov 2014 02:26:13 GMT https://community.splunk.com/t5/Getting-Data-In/JSON-time-not-always-extracted/m-p/191263#M38067 jeanmatthieu 2014-11-01T02:26:13Z https://community.splunk.com/t5/Getting-Data-In/JSON-time-not-always-extracted/m-p/191264#M38068 <P>Either setting MAX_TIMESTAMP_LOOKAHEAD = 0 or ensuring timestamp field is always the first field of the JSON document sorted my issue. </P> Mon, 28 Sep 2020 18:03:50 GMT https://community.splunk.com/t5/Getting-Data-In/JSON-time-not-always-extracted/m-p/191264#M38068 jeanmatthieu 2020-09-28T18:03:50Z