topic Re: Prepend all lines forwarded with a timestamp in Getting Data In

Prepend all lines forwarded with a timestamp

Kindred — Thu, 01 Oct 2015 16:06:32 GMT

Hi,

We have an application log that doesn't contain timestamps, but we'd actually like to have them within the raw event.

Is it possible (either on a Forwarder or at index time) to tell Splunk to prepend a timestamp to all lines it receives?

Re: Prepend all lines forwarded with a timestamp

richgalloway — Thu, 01 Oct 2015 18:21:55 GMT

In your props.conf file put DATETIME_CONFIG=CURRENT in the appropriate sourcetype stanza(s).

Re: Prepend all lines forwarded with a timestamp

Kindred — Fri, 02 Oct 2015 02:38:12 GMT

This adds a timestamp to the raw event? I thought that was just related to ordering? Will give it a try anyway and see.

Re: Prepend all lines forwarded with a timestamp

woodcock — Fri, 02 Oct 2015 03:32:08 GMT

It does NOT add it to the raw event but it causes the _time field to have the value of the time when the event was indexed on the indexer (roughly the time the event was forwarded from the forwarder).

Re: Prepend all lines forwarded with a timestamp

woodcock — Fri, 02 Oct 2015 03:39:46 GMT

This is not possible with just splunk; you will have to pre-process the events on the forwarder using some other software.

Re: Prepend all lines forwarded with a timestamp

Kindred — Fri, 02 Oct 2015 05:53:11 GMT

I thought as such since there are certain cases that would cause odd behaviour. When the forwarder is reading the file in (relatively) real-time and they are getting indexed in a similar amount of time, then the added log timestamp would be useful to understand the order of the events when looking at the logs afterwards (outside of Splunk), but since you may have network issues and delays in forwarding/reading the file - if it indexed the entire file at once they'd all have the same timestamp which isn't that useful.