topic How can we override Splunk's eventtime with timestamp value present in the event data coming from JMS MQ. in Getting Data In

How can we override Splunk's eventtime with timestamp value present in the event data coming from JMS MQ.

jincy_18 — Fri, 23 Feb 2018 07:38:28 GMT

I am fetching message queue message from JMS app in Splunk Enterprise 6.4.1. All the fields of the event are being extracted at indextime. I want to override the eventtime(_time) with the value present in the message(header timestamp). Please suggest how can this be achieved?

Re: How can we override Splunk's eventtime with timestamp value present in the event data coming from JMS MQ.

mayurr98 — Fri, 23 Feb 2018 08:33:08 GMT

@jincy_18, so you can configure custom timestamp in the existing props.conf of JMS MQ app. Most of the parsing phase is done at indexer / HF and since timestamp recognition is at parsing phase, try setting your props in indexer/heavy forwarder

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationparametersandthedatapipeline

http://docs.splunk.com/Documentation/Splunk/lastest/Data/Configuretimestamprecognition

let me know if this helps!

Re: How can we override Splunk's eventtime with timestamp value present in the event data coming from JMS MQ.

493669 — Tue, 29 Sep 2020 18:10:19 GMT

You need to set props.conf like:
1.TIME_PREFIX = <regular expression>
2.TIME_FORMAT = <in terms of %m/%d/%Y>
TIME_PREFIX is When set, Splunk software uses the specified regular expression to looks for a match before attempting to extract a timestamp.
for ex . props.conf should look like

[<sourcetype>]
TIME_PREFIX = <regular expression>
TIME_FORMAT = %m/%d/%y

If you could share some sample events so that regular expression and TIME_FORMAT can be build as per.
reference: http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Configuretimestamprecognition

Re: How can we override Splunk's eventtime with timestamp value present in the event data coming from JMS MQ.

jincy_18 — Fri, 23 Feb 2018 10:02:47 GMT

Thanks Rajesh,

Just to add on in our case the timestamp value will be an epoch value, will this pose an issue?

Re: How can we override Splunk's eventtime with timestamp value present in the event data coming from JMS MQ.

493669 — Fri, 23 Feb 2018 10:12:40 GMT

Ok jincy ...so you can add below for epoch

TIME_FORMAT=%s

Re: How can we override Splunk's eventtime with timestamp value present in the event data coming from JMS MQ.

493669 — Fri, 23 Feb 2018 10:14:54 GMT

%s for 10 digits