https://community.splunk.com/t5/Getting-Data-In/JSON-AN-HTTP-Event-Collector/m-p/463140#M79948 <P>How do you extract a timestamp from JSON logs that are being sent to an HTTP Event Collector?</P> <P>Hello<BR /> What solution can you give me to be able to extract the JSON programming time.<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7836i1B77B9FCF237B8A8/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 18 Oct 2019 15:42:00 GMT isabel09 2019-10-18T15:42:00Z https://community.splunk.com/t5/Getting-Data-In/JSON-AN-HTTP-Event-Collector/m-p/463140#M79948 <P>How do you extract a timestamp from JSON logs that are being sent to an HTTP Event Collector?</P> <P>Hello<BR /> What solution can you give me to be able to extract the JSON programming time.<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7836i1B77B9FCF237B8A8/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 18 Oct 2019 15:42:00 GMT https://community.splunk.com/t5/Getting-Data-In/JSON-AN-HTTP-Event-Collector/m-p/463140#M79948 isabel09 2019-10-18T15:42:00Z https://community.splunk.com/t5/Getting-Data-In/JSON-AN-HTTP-Event-Collector/m-p/463141#M79949 <P>Hello @isabel09,</P> <P>please find below a working example :</P> <PRE><CODE>| makeresults | eval _raw="{\"ENDTIME\":\"05/08/2019 17:36\",\"JOBCODE\":\"DAY_END_JOB\",\"STARTTIME\":\"05/08/2019 17:31\",\"STATUS\":\"COMPLETED\"}" | spath | eval _time=strptime(STARTTIME,"%d/%m/%Y %H:%M") </CODE></PRE> Thu, 07 Nov 2019 06:53:00 GMT https://community.splunk.com/t5/Getting-Data-In/JSON-AN-HTTP-Event-Collector/m-p/463141#M79949 poete 2019-11-07T06:53:00Z