topic Use JSON epoch date time instead of index time in Getting Data In

Use JSON epoch date time instead of index time

mkarimi17 — Wed, 15 Nov 2017 02:59:18 GMT

I have a JSON that is for emails like the following:

{   [-] 
     computer:  {   [+] 
    }   
     date:   2018-03-08T11:42:57+00:00      
     event_type_id:  553648152  
     timestamp:  1520509377 
     timestamp_nanoseconds:  893334279  
}

Note: the time above is in UTC.

However, my time is set to PST and so it looks like I'm getting the index time, timestamp of "11/14/17 6:50:49.000 PM"

This is what's in my props.conf:

[cisco:amp:json]
SHOULD_LINEMERGE = true
pulldown_type = 1
category = Splunk App Add-on Builder
LINE_BREAKER = ([\r\n]*)\{\"event_type\"\:
TIME_PREFIX = timestamp:\s*
TIME_FORMAT = %s
KV_MODE = json
TRANSFORMS-amp_hostname = force_amp_hostname
EXTRACT-amp_hostname = \"hostname\"\:\s*\"(?<dest>[^\"]*)
EXTRACT-amp_file_name = \"file_name\"\:\s*\"(?<file_name>[^\"]*)
EXTRACT-amp_file_path = \"file_path\"\:\s*\"(?<file_path>[^\"]*)
EXTRACT-amp_user = \"user\"\:\s?\"(?<user>[^\"]+)
EVAL-signature =
EVAL-action =
EVAL-file_hash =
BREAK_ONLY_BEFORE = ([\r\n]*)\{\"event_type\"\:
DATETIME_CONFIG =
NO_BINARY_CHECK = true
disabled = false
INDEXED_EXTRACTIONS = json

Re: Use JSON epoch date time instead of index time

gjanders — Wed, 15 Nov 2017 07:12:21 GMT

Are you looking for the timezone setting in the props.conf file ? As in TZ = UTC or similar?

Re: Use JSON epoch date time instead of index time

mkarimi17 — Wed, 15 Nov 2017 16:20:03 GMT

I tried that as well, sorry forgot to include it. But yeah that doesn't work either.

Re: Use JSON epoch date time instead of index time

niketn — Wed, 15 Nov 2017 18:24:45 GMT

@garethatiag, I have converted to comment since it seemed more like a question than answer.

Re: Use JSON epoch date time instead of index time

danbar6 — Wed, 15 Nov 2017 19:48:17 GMT

Did you check _internal logs for timestamp extraction related errors or warnings?

Re: Use JSON epoch date time instead of index time

niketn — Thu, 16 Nov 2017 02:50:55 GMT

@mkarimi17, the JSON in the sample, is that not how the data is sent? i.e. date: 2018-03-08T11:42:57+00:00 does not exist in your _raw data.

If your Timezone is set to PST using Logged in User > Account Settings in Splunk, then you should see event time as PST although the logged time in raw data is UTC.

What time do you see when you try to display the following:

<YourBaseSearch>
| table _time date_hour _raw

Re: Use JSON epoch date time instead of index time

jplumsdaine22 — Wed, 22 Nov 2017 17:16:31 GMT

in your inputs.conf (on the forwarder) setting you need this:

[monitor://path/to/file]
INDEXED_EXTRACTIONS = json

then in props use
[cisco:amp:json]
TIMESTAMP_FIELDS = timestamp