topic Re: define timestamp for json in Splunk Search

define timestamp for json

kirrusk — Fri, 11 Dec 2020 04:02:18 GMT

Hi,

I have a simple json like below ,

{"env":"p1","label":"1788_kapi_fed","App":"admin-ipo-sel","lastUpdate":"2020-10-18 19:03:16.956","region":"ea"}{"env":"p1","label":"1788_kapi_fed","App":"admin-ipo-sel","lastUpdate":"2020-10-19 18:29:43.136","region":"ea"}{"env":"p2","label":"1788_kapi_fed","App":"admin-ipo-sel","lastUpdate":"2020-10-19 19:29:45.136","region":"ea"}

timestamp field - "lastUpdate":"2020-10-19 19:29:43.136"

trying to define timestamp in props file with below stanza but not working

INDEXED_EXTRACTIONS = json

KV_MODE = none

AUTO_KV_JSON = false

TIME_PREFIX = lastUpdate\":\" tried with this as well (TIME_PREFIX = "lastUpdate":")

TIME_FORMAT = %Y-%m-%d %H:%M:%S.%N

MAX_TIMESTAMP_LOOKHEAD = 23

No events are coming to splunk with above data.

only below one is working to push data to splunk , Can any please suggest whats going wrong here

INDEXED_EXTRACTIONS = json

KV_MODE = none

AUTO_KV_JSON = false

TZ = Asia/Singapore

Re: define timestamp for json

to4kawa — Fri, 11 Dec 2020 14:12:59 GMT

Is one event one line?

Re: define timestamp for json

kirrusk — Fri, 11 Dec 2020 16:10:40 GMT

@to4kawa yes

Re: define timestamp for json

to4kawa — Fri, 11 Dec 2020 23:42:37 GMT

sample:

| makeresults | eval _raw="{\"env\":\"p1\",\"label\":\"1788_kapi_fed\",\"App\":\"admin-ipo-sel\",\"lastUpdate\":\"2020-10-18 19:03:16.956\",\"region\":\"ea\"}" | rex "lastUpdate\":\"(?<time>\S+ \S+?)\"" | eval _time=strptime(time,"%F %T.%3N")

TIME_PREFIX = lastUpdate\":\"
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N