topic Re: How to Timestamp Events in Getting Data In

How to Timestamp Events

skoelpin — Tue, 29 Dec 2015 16:43:35 GMT

I have an index which is not timestamping the events. I looked in the Docs and it said I have to define it in my props.conf

If this is true, can someone help me with the correct stanza?

Here's what a few of my non-timestamped events look like

1451406708913 172.xx.xx.xx - 160195 98610 3.12 1.19 200 21105 0 8 /graph?node=10904&profiles=roomsOnly

1451406708879 172.xx.xx.xx - 160194 13073 4.50 3.69 200 6 0 8 /graph?node=10930

Re: How to Timestamp Events

renjith_nair — Tue, 29 Dec 2015 16:54:34 GMT

Try this

http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Configuretimestamprecognition

More read : http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/HowSplunkextractstimestamps

Re: How to Timestamp Events

skoelpin — Tue, 29 Dec 2015 17:02:02 GMT

I read those docs before posting here.. It looks like the timestamp is being assigned to some hosts in that index and not assigning a timestamp to other hosts

How do I get a timestamp on ALL hosts?

Re: How to Timestamp Events

jkat54 — Tue, 29 Sep 2020 08:13:31 GMT

The stanza you need to change in props.conf will be named after the sourcetype of the data.

I'm making comment on renjith.nair's response because if you read the documentation you'll understand this. However i'm also giving you the answer here:

[sourcetypeName]
TIME_PREFIX = ^
TIME_FORMAT = %s%3n

Finally, I must also note this looks like web traffic logs which splunk already has many sourcetypes preconfigured for. You might benefit more by using the IIS logs or Apache logs sourcetypes.

Re: How to Timestamp Events

jkat54 — Tue, 29 Dec 2015 17:22:15 GMT

Please explain what is meant by ALL hosts?

Do you have some hosts which are sending this data in without the correct timestamps? If so check that props.conf is on every indexer and forwarder that is sending the data in, even the universal forwarders.