topic Index events with timestamp of previous day in Getting Data In

Index events with timestamp of previous day

rajeshjlnt — Tue, 03 Nov 2020 06:23:43 GMT

We have a report from a system that needs to be indexed into splunk on monthly basis. This report is generated on 1st day of every month.

Our requirement is to index events in this report on last day of previous month. So i want to index data from this report with timestamp of previous day.

Is this possible?

Re: Index events with timestamp of previous day

isoutamo — Tue, 03 Nov 2020 07:07:23 GMT

I'm not sure if I understood right your question, but you could get last month events by the next query:

index=_internal earliest=-1mon@mon latest=-0mon@mon | stats earliest(_time) as eTime latest(_time) as lTime | eval eTime = strftime(eTime, "%F %T %z"), lTime = strftime(lTime, "%F %T %z") | table eTime lTime

To show reports day e.g. as last day of previous month just take day part of lTime (I suppose that you have events on it).

r. Ismo

Re: Index events with timestamp of previous day

rajeshjlnt — Tue, 03 Nov 2020 07:35:19 GMT

Thanks for your response @isoutamo , but my question is to manipulate timestamp during indexing events.

During event indexing there are settings in sourcetype like Auto, Current, Advanced and Configuration file. I would like to know if there is a way to set timestamp to be (current time - 1 day)

Re: Index events with timestamp of previous day

isoutamo — Tue, 03 Nov 2020 07:58:29 GMT

I haven't try this but there is INGEST_EVAL on transforms.conf (https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Transformsconf) which can help you.
r. Ismo

Re: Index events with timestamp of previous day

rajeshjlnt — Tue, 03 Nov 2020 12:13:36 GMT

thanks @isoutamo for showing right direction

Re: Index events with timestamp of previous day

rajeshjlnt — Tue, 03 Nov 2020 12:21:23 GMT

I added following in props.conf and transforms.conf to get the desired results,

transforms.conf

[timestamp-currenttime-oneday]
INGEST_EVAL = _time=time() - 86400

props.conf

[mysourcetype]
TRANSFORMS-gettime = timestamp-currenttime-oneday