Multiple timestamp fields with same field name

wwhite12 — Wed, 30 Sep 2020 05:26:37 GMT

I have some json data events that has multiple "date" fields. The date field I am looking to use as my timestamp comes at the end of every event and it appears that Splunk is using whichever date field it reads first. Is there a way to specify which date field to use? The fields are in different time formats and even though I am specifying the time format for epoch time, it still appears to be incorrectly reading the first timestamp.

props.conf:
[sourcetype]
SHOULD_LINEMERGE=true
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
AUTO_KV_JSON=false
CHARSET=UTF-8
INDEXED_EXTRACTIONS=json
KV_MODE=none
TRUNCATE=20000
category=Structured
description=JavaScript Object Notation format. For more information, visit http://json.org/
disabled=false
pulldown_type=true
TIME_PREFIX="date":+
TIME_FORMAT=%s%3N
MAX_TIMESTAMP_LOOKAHEAD=13

Data Sample:
{"message”:”[messageType] This is a message",”type":"IntegrationLog","level":"WARN","details":{"_incomingData":{"_parsedData":{"hostNotificationNumber":"1","date":"2020-04-01”},”dateType”:”blah”,”integrationName”:”blahblahblah”,”incomingDataId”:”xxxxxxxxxxxxxxx”}},”date":1585775200775}

Re: Multiple timestamp fields with same field name

richgalloway — Thu, 14 May 2020 17:42:12 GMT

Can you be more specific with TIME_PREFIX? Perhaps }, "date":?

Re: Multiple timestamp fields with same field name

wwhite12 — Thu, 14 May 2020 20:33:03 GMT

nailed it. Also weird to note, this was initially not working until I removed the plus sign from the TIME_PREFIX config. Once I removed that everything looks good.

topic Re: Multiple timestamp fields with same field name in Getting Data In

Multiple timestamp fields with same field name

Re: Multiple timestamp fields with same field name

Re: Multiple timestamp fields with same field name