topic Re: HEC timestamp parsing in Getting Data In

HEC timestamp parsing

PickleRick — Tue, 13 Jul 2021 13:28:47 GMT

Hello there.

I noticed lately (in a kinda painful way 😉) that if the time field is present in json sent to a HEC collector endpoint, the timestamp is not getting parsed from the message. But since the documentation differs between 8.0 and 7.x in this regard (https://docs.splunk.com/Documentation/Splunk/7.3.9/Data/HECRESTendpoints - doesn't say a word about timestamp parsing whereas 8.0.0 gives whole paragraph about optional parameter affecting the parsing) - does anyone know whether the 7.x versions behaved the same way?

I mean - did the timestamp parsing in 7.x also wasn't performed at all if the time field was present?
Did the behaviour changed or was it simply that the docs were supplemented?

Re: HEC timestamp parsing

richgalloway — Tue, 13 Jul 2021 13:51:19 GMT

Submit feedback on the 7.3.9 docs asking for clarification.

Re: HEC timestamp parsing

PickleRick — Tue, 13 Jul 2021 23:45:13 GMT

Well... Doesn't hurt to try 🙂

Thanks for the suggestion.

Re: HEC timestamp parsing

vik_splunk — Wed, 10 Jan 2024 14:21:28 GMT

@PickleRick did you manage to figure out a solution to this, please?

Re: HEC timestamp parsing

PickleRick — Thu, 11 Jan 2024 07:26:55 GMT

No. I assume that there is simply no ?auto_extract_timestamp=true functionality for versions before 8.0.

After that - it works OK.