topic Re: how to set TIME_PREFIX for a json file? in Getting Data In

how to set TIME_PREFIX for a json file?

anooshac — Wed, 30 Sep 2020 04:04:35 GMT

I have a JSON file like this.
{
"ACC_NAME": "A",
"DEPT": [{
"NAME": "D1",
"PROJECT": [{
"P_NAME": "xyz",
"START_DATE": "1/5/2020 5:01:00",
"END_DATE": "1/31/2020 7:21:32",
"STATUS": "PASS"
}]
}]
}
I have been trying to set TIME_PREFIX and it's not working. As you can see there are two dates.When I set TIME_PREFIX= START_DATE i got time stamp error. How can i set TIME_PREFIX so that both the dates are included?

Re: how to set TIME_PREFIX for a json file?

493669 — Mon, 10 Feb 2020 11:06:07 GMT

Hi @anooshac, try below by escaping special characters-

TIME_PREFIX= \"START_DATE\": \"

Re: how to set TIME_PREFIX for a json file?

493669 — Mon, 10 Feb 2020 11:08:08 GMT

Also provide Time_format as per your time format is like below-

TIME_FORMAT=%d/%m/%Y %H:%M:%S

Re: how to set TIME_PREFIX for a json file?

anooshac — Mon, 10 Feb 2020 11:13:29 GMT

hi i tried that and i'm still getting as "Failed to parse timestamp". How can i include the END_DATE aslo?

Re: how to set TIME_PREFIX for a json file?

493669 — Wed, 30 Sep 2020 04:04:38 GMT

Timestamp is assigned with only one field either START_DATE or END_DATE .
Can you share your props.conf ? (in code block)

Re: how to set TIME_PREFIX for a json file?

anooshac — Wed, 30 Sep 2020 04:09:05 GMT

[_json]
DATETIME_CONFIG =
LINE_BREAKER = ([\r\n]+)
disabled = false
TIME_FORMAT = %m/%d/%Y %H:%M:%S %z
TIME_PREFIX = \"START_DATE\": \"
MAX_TIMESTAMP_LOOKAHEAD = 128
BREAK_ONLY_BEFORE_DATE =

This is props.conf file.

Re: how to set TIME_PREFIX for a json file?

to4kawa — Mon, 10 Feb 2020 12:30:52 GMT

LINE_BREAKER = ([\r\n]+)

your JSON is one line?

Re: how to set TIME_PREFIX for a json file?

anooshac — Tue, 11 Feb 2020 03:25:41 GMT

hi @to4kawa , no my json is not a one line file.

Re: how to set TIME_PREFIX for a json file?

manjunathmeti — Tue, 11 Feb 2020 04:00:47 GMT

Since you are trying to set timestamp for the events, you can try below configuration.

[_json]
INDEXED_EXTRACTIONS = json
KV_MODE = none
AUTO_KV_JSON = false
TIMESTAMP_FIELDS = DEPT.PROJECT.START_DATE

Re: how to set TIME_PREFIX for a json file?

anooshac — Tue, 11 Feb 2020 05:39:44 GMT

hi @manjunathmeti , thank you so much!!! It is working, and i am getting all the fields of the json file.