topic Scripted input with powershell - SplunkTime not working in Getting Data In

Scripted input with powershell - SplunkTime not working

mark19632 — Tue, 29 Sep 2020 08:10:47 GMT

Hi,

I have a PowerShell script that's being executed, but the event time is showing as the time the script runs.

The script outputs objects like this:

SplunkTime : 12/05/2015 15:32:06
RESEND_TYPE : 12404
SHOP_CODE : 1535
START_DAY : 512
START_NUMBER : 75244
END_DAY : 512
END_NUMBER : 75245
REQUEST_RECEIVED_AT : 12/05/2015 15:32:06

I've added the SplunkTime, but it's not shown on the search and the time is time the run time:
17/12/2015
22:43:27.000

RESEND_TYPE="12404"
SHOP_CODE="1535"
START_DAY="512"
START_NUMBER="97772"
END_DAY="512"
END_NUMBER="97773"
REQUEST_RECEIVED_AT="12/05/2015 17:19:36"

Any ideas?

Thanks,

Mark

Re: Scripted input with powershell - SplunkTime not working

javiergn — Fri, 18 Dec 2015 13:58:52 GMT

What's in your props.conf?

Re: Scripted input with powershell - SplunkTime not working

mark19632 — Fri, 18 Dec 2015 15:51:39 GMT

Nothing related to this.

I thought Splunk you pickup the time from the SplunkTime variable as per:

http://docs.splunk.com/Documentation/Splunk/6.3.0/Data/MonitorWindowsDatawithPowerShellscripts

Thanks,

Mark

Re: Scripted input with powershell - SplunkTime not working

javiergn — Fri, 18 Dec 2015 16:03:31 GMT

Try renaming your SplunkTime variable to _time in PowerShell and see if that works.
Splunk should pick up the time automatically, but what I can see from your output is that there are multiple times being returned, and that might lead to confusions.

That's the reason you need a props.conf stanza for your sourcetype where you specify things like your time format, prefix, lookahead, etc.

Take a look at this: http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition