topic Re: How do I set _time with collect _raw? in Getting Data In

How do I set _time with collect _raw?

yurykiselev — Tue, 29 Sep 2020 21:30:29 GMT

Hi!
I have to collect some JSON "as is" - not as key-value pair. How can I set event timestamp in this case?

... | eval _time=strptime(...) | table _time _raw | collect index="..."

... doesn't work: _time is ignored with _raw present and replaced with cirrent time. I could do:

... | eval data = _raw | table _time data | collect ...

, but it generates key-value-event with "data={my_json_from_raw}"

Re: How do I set _time with collect _raw?

VatsalJagani — Tue, 29 Sep 2020 21:33:57 GMT

Hi @yurykiselev,
If time is already in the _raw in a format that Splunk can understand easily then you will add addtime=false as a option with collect command and Splunk will automatically extracts time from _raw no need to extract separately.

If not the above scenario then you have to write props.conf for the source-type you are using.

If time format is weird then you must have specify time format into TIME_FORMAT. (This may help you in writing that format)
If time format is not available within first 128 characters of _raw event then you have to add MAX_TIMESTAMP_LOOKAHEAD.
You can also specify TIME_PREFIX. (props.conf may help you in all the configuration writing)

Hope this helps!!

Re: How do I set _time with collect _raw?

yurykiselev — Mon, 08 Oct 2018 13:24:08 GMT

Thank you! I added date at begin of data "%Y-%m-%d %H:%M:%S" - it's recignized without any props defineding.

Re: How do I set _time with collect _raw?

VatsalJagani — Mon, 08 Oct 2018 14:13:22 GMT

Nice!!, This time format is identify by Splunk so good for you.