<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: I have a JSON file with two timestamps. How do I edit props.conf to extract the second timestamp? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/I-have-a-JSON-file-with-two-timestamps-How-do-I-edit-props-conf/m-p/238392#M46299</link>
    <description>&lt;P&gt;If you have that many  &lt;CODE&gt;\&lt;/CODE&gt; in the data to escape the &lt;CODE&gt;"&lt;/CODE&gt; then you can try putting following in &lt;CODE&gt;TIME_PREFIX&lt;/CODE&gt; which should point it to the appropriate string you are interested in. &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;TIME_PREFIX = \\\"timestamp\\\":\\\"
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Fri, 25 Nov 2016 08:37:32 GMT</pubDate>
    <dc:creator>gokadroid</dc:creator>
    <dc:date>2016-11-25T08:37:32Z</dc:date>
    <item>
      <title>I have a JSON file with two timestamps. How do I edit props.conf to extract the second timestamp?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/I-have-a-JSON-file-with-two-timestamps-How-do-I-edit-props-conf/m-p/238391#M46298</link>
      <description>&lt;P&gt;I have a JSON file with two timestamps. I would like to extract the second timestamp (highlighted in bold). I have tried props.conf configuration file in indexer as given below&lt;/P&gt;

&lt;P&gt;props.conf&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;KV_MODE=none
TIME_PREFIX = 
MAX_TIMESTAMP_LOOKAHEAD=100
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;sample file&lt;/P&gt;

&lt;P&gt;[&lt;BR /&gt;
    {&lt;BR /&gt;
        "ApproximateArrivalTimestamp": "2016-11-01 13:43:29.857000+00:00",&lt;BR /&gt;
        "Data": "{\"id\":\"9598390425884735158\",\"packetType\":\"sSns\",\"projectId\":845,\"adapterId\":\"1087\",\"time\":30095764,\"gid\":\"01:d8:95:24:ef:56:aa\",\"version\":\"1\",\"&lt;STRONG&gt;timestamp\":\"2016-11-07T13:43:29.316Z&lt;/STRONG&gt;\",\"adapterType\":\"Blufi\",\"battery\":3630,\"temp\":25.0,\"eventCounter\":[3864,2797,237,2263,0,0],\"xAccel\":-0.95703125,\"yAccel\":0.08203125,\"zAccel\":0.046875}",&lt;BR /&gt;
        "PartitionKey": "p:845:b:1087",&lt;BR /&gt;
        "SequenceNumber": "49560220030257590074301033785634074783409781971940802562"&lt;BR /&gt;
    }&lt;BR /&gt;
]&lt;/P&gt;</description>
      <pubDate>Fri, 25 Nov 2016 05:31:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/I-have-a-JSON-file-with-two-timestamps-How-do-I-edit-props-conf/m-p/238391#M46298</guid>
      <dc:creator>anilchaithu</dc:creator>
      <dc:date>2016-11-25T05:31:49Z</dc:date>
    </item>
    <item>
      <title>Re: I have a JSON file with two timestamps. How do I edit props.conf to extract the second timestamp?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/I-have-a-JSON-file-with-two-timestamps-How-do-I-edit-props-conf/m-p/238392#M46299</link>
      <description>&lt;P&gt;If you have that many  &lt;CODE&gt;\&lt;/CODE&gt; in the data to escape the &lt;CODE&gt;"&lt;/CODE&gt; then you can try putting following in &lt;CODE&gt;TIME_PREFIX&lt;/CODE&gt; which should point it to the appropriate string you are interested in. &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;TIME_PREFIX = \\\"timestamp\\\":\\\"
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Fri, 25 Nov 2016 08:37:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/I-have-a-JSON-file-with-two-timestamps-How-do-I-edit-props-conf/m-p/238392#M46299</guid>
      <dc:creator>gokadroid</dc:creator>
      <dc:date>2016-11-25T08:37:32Z</dc:date>
    </item>
  </channel>
</rss>

