topic assign cron time to timestamp in Getting Data In

assign cron time to timestamp

yaaseensalie — Tue, 15 Sep 2020 13:01:29 GMT

Hi,

I have a rest call that runs every 24hours, and the number of events that are returned are in the region of +500 000 this obviously takes a few minutes to get everything into Splunk.

The problem is that the timestamps are completely out, I want all events to have the cron timestamp instead of the indexed time. I've tried

DATETIME_CONFIG = NONE

and I've tried

DATETIME_CONFIG = CURRENT

is there anything else I can try?

Thanks

Re: assign cron time to timestamp

ITWhisperer — Tue, 15 Sep 2020 13:10:59 GMT

Try overriding _time in your query

| eval _time=now()

Or perhaps

| eval start=now()

toward the beginning of your query, and

| eval _time=start

towards the end

Re: assign cron time to timestamp

yaaseensalie — Wed, 16 Sep 2020 11:34:38 GMT

Thanks @ITWhisperer for the reply

But The GET request takes a while to get the results into Splunk, I'm using these results to create a lookup. I would like to use the CRON time as my timestamp for my events, I don't want to override anything in SPL. I'm trying to find a solution which is during Index time and not Search Time.