topic Re: Using a field within a log for the true timestamp in Getting Data In

Using a field within a log for the true timestamp

aferone — Thu, 01 Sep 2016 15:51:08 GMT

Here si the example log:

Sep 1 11:23:48 HOSTNAME netflow: timestamp=2016-08-30T12:51:07.593 duration=1.246 proto=6 srcip=1.1.1.1 srcport=80 dstip=2.2.2.2 dstport=62018 inpkt=5 inbyte=724 outpkt=6 outbyte=815 fl=2

The fieldname "timestamp" is the true timestamp of the event. The first date in the log is just when the netflow data was converted.

How do I use "timestamp" as the Splunk date/time? I know how to do timestamps when the times are the first part of the log, but not within it.

Thanks!

Re: Using a field within a log for the true timestamp

sundareshr — Thu, 01 Sep 2016 16:23:07 GMT

The below config in your props.conf on the indexer/hf should do the trick

[unique_stanza_name]
 TIME_PREFIX = timestamp=
 TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N

Verify correct stanza name, restart splunk service on indexer. All new data will have this field value for _time

Re: Using a field within a log for the true timestamp

aferone — Thu, 01 Sep 2016 18:26:34 GMT

Works like a champ! Thanks for responding!