topic Re: [HEC] timestamp recognition in Getting Data In

[HEC] timestamp recognition

sylim_splunk — Fri, 29 Jan 2021 00:36:06 GMT

We have data ingesting into Splunk via HEC token, and observed the time parsing of the event is not taking properly.
Example - In the event the timestamp looks like 2020-12-01 09:59:18.0674, but in the Splunk it was capturing 12/1/20 9:59:18.000 AM. Here missing the millisecond in the Splunk time but it's not limited to the millisecond.. sometimes the second field are not correct..

We tried applying the time format and time prefix for the source and sourcetype as below, but it is not fixing the issue.
TIME_PREFIX = "Date": "
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%4N

And also tried the props.conf below;

[the_sourcetype]
AUTO_KV_JSON = false
INDEXED_EXTRACTIONS = json
TIMESTAMP_FIELDS = Date

We use collector/event REST endpoint.

Splunk version 7.2.8.

Re: [HEC] timestamp recognition

sylim_splunk — Fri, 29 Jan 2021 00:32:41 GMT

With 7.2.8 must use collector/raw, not collector/event to recognize timestamp in the payload.

Ver 8.0 with auto_extract_timestamp has been implemented for collector/event
The timestamp recognition issue of this case happened as it's not using collector/raw endpoint.
https://docs.splunk.com/Documentation/Splunk/latest/Data/FormateventsforHTTPEventCollector#Raw_event_parsing

i) Use 'collector/raw' endpoint then it will detect a correct timestamp.

ii) Upgrade Splunk to 8.0 or above and use auto_extract_timestamp=true with "collector/event".

for example, in 8.0+
$ curl -k http://localhost:8088/services/collector/event?auto_extract_timestamp=true -H "Authorization: Splunk <TOKEN>" -H "content-Type: application/json" -d '{"event": "2020-12-16 00:00:00 Hellow world"}'