topic Re: Props.conf Timestamp Not Parsing in Getting Data In

Props.conf Timestamp Not Parsing

jordanking1992 — Wed, 30 Sep 2020 00:30:35 GMT

Hello,

We have events that are being indexed with "index time" timestamps and would like to use the timestamp from the event itself. When i upload the logs to our standalone host, splunk recognizes the timestamps from the logs and present us with the following fields for that sourcetype. (see below) However, when we deploy this to our indexers and resttart the service, events come in with the what appears to be index time timestamps. For some reason, splunk isnt recognizing the milliseconds portion of the event.

Thoughts?

[sourcetype-a]
MAX_TIMESTAMP_LOOKAHEAD = 128
TIME_PREFIX = [
TIME_FORMAT = %m/%d/%y %H:%M:%S:%N %Z
BREAK_ONLY_BEFORE = ^[\d{1,2}/\d{1,2}/\d{1,2}\s+\d{1,2}:\d{1,2}:\d{1,2}
MAX_EVENTS = 10000

Re: Props.conf Timestamp Not Parsing

shawnab — Tue, 14 May 2019 17:21:31 GMT

Try using %3N

"For GNU date-time nanoseconds. Specify any sub-second parsing by providing the width: %3N = milliseconds, %6N = microseconds, %9N = nanoseconds."

https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Configuretimestamprecognition

Re: Props.conf Timestamp Not Parsing

woodcock — Tue, 14 May 2019 17:43:33 GMT

Try this:

TIME_PREFIX = \[
TIME_FORMAT = %m/%d/%y %H:%M:%S:%3N %Z
MAX_TIMESTAMP_LOOKAHEAD = 25

Deploy to the first full instance of Splunk that handles the events (HF or Indexers), restart all splunk instances there, send in new events and only check those (old events will stay broken); use _index_earliest=-5m to be sure that you are looking at newly-indexed events.