topic Re: Timestamp from GPS data.. in Getting Data In

Timestamp from GPS data..

eyirik — Mon, 13 Feb 2017 12:39:53 GMT

Hi,

I get data from source via TCP. Below you can see raw data;

2017-02-13T12:20:18.000Z;d7:86:47:6a:f7:84;sourcetype1;36.988593333;35.193628333

the raw data is ";" delimited and first line is time from coming GPS.

How can i assign this GPS time data as timestamp ?

Re: Timestamp from GPS data..

martin_mueller — Mon, 13 Feb 2017 12:46:20 GMT

Splunk's default auto detection will find this timestamp and time zone.

That being said, whenever possible you should define the extraction - e.g. like this in props.conf:

SHOULD_LINEMERGE=false
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%Z
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=30

Re: Timestamp from GPS data..

eyirik — Tue, 29 Sep 2020 12:50:54 GMT

Yes, it detects with different time zone.

ı wrote below in props.conf. but id does not work.

[MD9electriCITY]
SHOULD_LINEMERGE = False
TIME_FORMAT=%Y-%m-%DT%H:%M:%S.%3N%Z
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=30
pulldown_type = 1
REPORT-getfields = temsaapp_fields

[host::5.11.243.33]
TZ = Asian/Istanbul

Re: Timestamp from GPS data..

esix_splunk — Tue, 14 Feb 2017 05:56:02 GMT

Set your timezone on the forwarder where you are ingesting the data.

Re: Timestamp from GPS data..

eyirik — Tue, 14 Feb 2017 05:59:11 GMT

i read it from TCP:9999 .

Re: Timestamp from GPS data..

esix_splunk — Tue, 14 Feb 2017 06:02:41 GMT

What host value comes in for that data? Is it the IP or the DNS / FQDN name? That host stanza will only work if it sees it coming in as the 5.11.243.33 ip address, and not as a hostname.

Check the host field in search, and adjust as neccesary if it isnt correct.

Re: Timestamp from GPS data..

eyirik — Tue, 14 Feb 2017 06:10:12 GMT

It comes from IP address: 5.11.243.33

host="5.11.243.33"

Re: Timestamp from GPS data..

esix_splunk — Tue, 14 Feb 2017 06:19:50 GMT

Checking here ; https://en.wikipedia.org/wiki/List_of_tz_database_time_zones

Should be

TZ = Asia/Istanbul        or
TZ = Europe/Istanbul

Not ....

TZ= Asian/Istanbul

Try that.

Re: Timestamp from GPS data..

martin_mueller — Tue, 14 Feb 2017 09:58:06 GMT

The timestamp explicitly states Z / Zulu / UTC as its time zone, and GPS runs on UTC (ignoring leap seconds). Make sure your data actually is a different time zone despite claiming to be UTC, and if possible fix this at the source to avoid other people tripping over the then-incorrect time zone delcaration inside the data.

Re: Timestamp from GPS data..

eyirik — Tue, 29 Sep 2020 12:51:10 GMT

Time Event
2/14/17 5:12:41.000 AM 2017-02-14T10:12

i wrote props.conf like below (corrected time/zone) .

UTC GPS time is correct, but timestamp in splunk is in different time zone ?

[MD9electriCITY]
SHOULD_LINEMERGE = False
TIME_FORMAT=%Y-%m-%DT%H:%M:%S.%3N%Z
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=30
pulldown_type = 1
REPORT-getfields = temsaapp_fields

[host::5.11.243.33]
TZ = Asia/Istanbul

Re: Timestamp from GPS data..

martin_mueller — Tue, 14 Feb 2017 10:33:41 GMT

The timestamp inside splunk is displayed with the splunk user's time zone.