topic Re: TIME_FORMAT in Epoch in Splunk Search

TIME_FORMAT in Epoch

shangshin — Mon, 12 May 2014 15:55:38 GMT

Hi,
My log event is in xml and the timestamp is in epoch format e.g. <timestamp>1399909145002</timestamp>

How can I define this in props.conf so the event timestamp will be correctly indexed in splunk?

Thanks in advance!

Re: TIME_FORMAT in Epoch

dmaislin_splunk — Mon, 12 May 2014 16:15:44 GMT

TIME_PREFIX = \<timestamp\>

Re: TIME_FORMAT in Epoch

dmaislin_splunk — Mon, 12 May 2014 16:16:53 GMT

If you showed me an entire XML event then I could help you with your event line breaking too.

Re: TIME_FORMAT in Epoch

shangshin — Mon, 12 May 2014 16:23:06 GMT

The magic works. Thank you.

Re: TIME_FORMAT in Epoch

dmaislin_splunk — Mon, 12 May 2014 16:24:00 GMT

Excellent! Thanks for the upvote!

Re: TIME_FORMAT in Epoch

dwaddle — Mon, 12 May 2014 16:24:31 GMT

Well, you have a slight complication there. What you have there isn't truly epoch (number of seconds since 1/1/1970 00:00:00 GMT). What you have is the number of milliseconds.

But it appears this will work --

[test2] 
TIME_PREFIX=<timestamp> 
TIME_FORMAT=%s%3N

Re: TIME_FORMAT in Epoch

dmaislin_splunk — Mon, 12 May 2014 16:45:18 GMT

Good point!