topic Re: What do we need to write in TIME_FORMAT in props.conft to extract a timestamp? in Getting Data In

What do we need to write in TIME_FORMAT in props.conft to extract a timestamp?

vishaltaneja070 — Wed, 05 Dec 2018 07:29:35 GMT

How do you extract a timestamp in an event like this "2018-12-05T00:31:03.711Z"?

Like, what do we need to write in TIME_FORMAT in props.conf?

Re: What do we need to write in TIME_FORMAT in props.conft to extract a timestamp?

bjoernjensen — Wed, 05 Dec 2018 07:36:15 GMT

Hey,

Splunk should handle that automatically:

What exactly is not working at your side?

Re: What do we need to write in TIME_FORMAT in props.conft to extract a timestamp?

prakash007 — Sat, 08 Dec 2018 02:18:01 GMT

Hope this should work..

[<sourcetype>]
SHOULD_LINEMERGE = false
TIME_PREFIX = ^\"
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%Z
MAX_TIMESTAMP_LOOKAHEAD = 25

Re: What do we need to write in TIME_FORMAT in props.conft to extract a timestamp?

skoelpin — Sat, 08 Dec 2018 20:39:45 GMT

I think you're asking how Splunk identifies the timestamp in the raw logs rather than how Splunk extracts it

Re: What do we need to write in TIME_FORMAT in props.conft to extract a timestamp?

woodcock — Sat, 08 Dec 2018 22:11:54 GMT

No, no, no! Never, EVER let Splunk do anything related to timestamping or sourcetyping automatically!

Re: What do we need to write in TIME_FORMAT in props.conft to extract a timestamp?

skoelpin — Sat, 08 Dec 2018 23:38:34 GMT

Correct. ALWAYS explicitly tell Splunk how to line break and timestamp

Re: What do we need to write in TIME_FORMAT in props.conft to extract a timestamp?

whrg — Mon, 10 Dec 2018 21:54:11 GMT

Hi @vishaltaneja07011993! Can you post one whole event? Because it matters where the timestamp is situated in the event and you might need to configure TIME_PREFIX accordingly.