topic Re: Correcting timestamp with ingest-time eval? in Knowledge Management

Correcting timestamp with ingest-time eval?

PickleRick — Tue, 07 Dec 2021 14:29:32 GMT

I have a quite unusual case. One of my sources emits logs with a very stupid timestamp format. It consists of a date and time glued together, which on its own is quite ok, but followed with a timezone info in form of time difference vs UTC expressed... in minutes.

So it's not your typical "+0200". No. It's "+120". There's no such timezone format in your strptime format specification so I have to do it some other way. Since _time is crucial to the proper event processing, of course I have to adjust it in ingest time.

I thought about parsing the offset from the timestamp as an independent field and then correcting the _time field before indexing the event. Does it make sense? I don't see any other way of producing correct timestamp from such data.

Re: Correcting timestamp with ingest-time eval?

isoutamo — Tue, 07 Dec 2021 20:48:44 GMT

Hi
That should work. If I recall right there are somewhere this kind of examples for using ingest time eval.
R. Ismo

Re: Correcting timestamp with ingest-time eval?

PickleRick — Wed, 08 Dec 2021 07:32:05 GMT

Thx for confirmation. 🙂

Re: Correcting timestamp with ingest-time eval?

isoutamo — Wed, 08 Dec 2021 08:29:22 GMT

It was this what I refer https://conf.splunk.com/files/2020/slides/PLA1154C.pdf and

4. Configuration to Demultiplex Conflicting Time Formats