topic Re: why splunk extracts the second timestamp instead of first in Splunk Search

why splunk extracts the second timestamp instead of first

net1993 — Fri, 02 Aug 2019 09:10:38 GMT

I investigate issue of creating too many new warm buckets and while I do that, one of the events which according to log splunkd has issues has strange problem which I am curious to find out why this happens.

The event:
fdsfds fsdf as dsfsd fdsfds fdsfds fdsfd dsfds dsf.dd

Re: why splunk extracts the second timestamp instead of first

net1993 — Fri, 02 Aug 2019 09:22:56 GMT

For some reason I cannot post the whole event so I place it as comment:
fdsfds fsdf as dsfsd fdsfds fdsfds fdsfd dsfds dsf.dd

Re: why splunk extracts the second timestamp instead of first

richgalloway — Fri, 02 Aug 2019 12:51:06 GMT

The body of your question appears unrelated to the topic.
Where are the timestamps in your sample event? What are the props.conf settings for the event's sourcetype?

Re: why splunk extracts the second timestamp instead of first

net1993 — Fri, 02 Aug 2019 12:56:15 GMT

Sorry, splunks website filters timestamps for some reason. I tried to paste it many times but its same.
Basicaly: I have 1 event with first 1 unix timestamp and then there is another timestamps with format: Y-m-d h:i:s... and splunk for some reason takes the second timestamp even thought its after the epoch timestamp which is my question why it does that. The sourcetype is default and nothing custom in it.

Re: why splunk extracts the second timestamp instead of first

jnudell_2 — Fri, 02 Aug 2019 13:04:09 GMT

Enclose your sample event in either backticks ():2019-08-02T00:00:00.000 timestamp1 Jan 1, 1970 00:01:02.003 timestamp2`
or code tags:
< pre> ... < /pre>
(remove the space after the opening less than sign)



2019-08-02T00:00:00.000 timestamp1 Jan 1, 1970 00:01:02.003 timestamp2

Re: why splunk extracts the second timestamp instead of first

richgalloway — Fri, 02 Aug 2019 13:24:10 GMT

It sounds like the two timestamps have different formats and Splunk is finding the one that matches what is in datetime.xml. You need to override that using the props.conf settings TIME_PREFIX, TIME_FORMAT, and MAX_TIMESTAMP_LOOKAHEAD. As soon as you post examples of the timestamps we can tell you what the settings should be.