topic Re: How to edit our props.conf to assign a time field in our sample JSON event as the event timestamp? in Splunk Search

How to edit our props.conf to assign a time field in our sample JSON event as the event timestamp?

dhavamanis — Tue, 29 Sep 2020 10:25:14 GMT

Can you please tell us how to assign event log time (ALERT_TIMESTAMP fields value ) as the event timestamp (_time)? Seems the below props.conf entry is not working properly. Please review and provide a working sourcetype configuration for extracting fields and assigning timestamp from event data.

props.conf:

[vops_json]
INDEXED_EXTRACTIONS = json
NO_BINARY_CHECK = true
TIMESTAMP_FIELDS = ALERT_TIMESTAMP
TIME_FORMAT = %s
KV_MODE = json
SHOULD_LINEMERGE = True
TRUNCATE = 0
category = Custom
description = JavaScript Object Notation format. For more information, visit http://json.org/
disabled = false
pulldown_type = true

Sample Event:

{
"ALERT_SERVICESTATE": "OK",
"ALERT_VO_RECIEVE_TIME": "1469712777061",
"ALERT_URL": "http://test.url.com/test",
"ALERT_ENTITY_DISPLAY_NAME": "test entity",
"ALERT_ENTITY_STATE": "OK",
"ALERT_MESSAGE_TYPE": "RECOVERY",
"ALERT_MONITOR_NAME": "",
"ALERT_MONITORING_URL": "NAGIOS",
"ALERT_ROUTING_KEY": "admins_support",
"ALERT_TIMESTAMP": "1469712369000",
"ALERT_ENTITY_TYPE": "SERVICE",
"STATE_ACK_MESSAGE": "",
"STATE_ACK_TIMESTAMP": "1469712775000",
"STATE_ACK_USER": "test_coca",
"STATE_ALERT_COUNT": "2",
"STATE_CURRENT_ALERT_PHASE": "ACKED",
"STATE_CURRENT_STATE": "WARNING",
"STATE_ENTITY_ID": "nagios-publisher\/ec2-52-90-166-168.compute-1.amazonaws.com\/Memory",
"STATE_HOST": "ec2-52-90-166-168.compute-1.amazonaws.com",
"STATE_INCIDENT_NAME": "9106",
"STATE_INCIDENT_TIMESTAMP": "1469712369000",
"STATE_LAST_TIMESTAMP": "1469712369000",
"STATE_MONITOR_TYPE": "NAGIOS",
"STATE_SERVICE": "nbcdevfiles-4a23d9b2  \/ Memory"
}

Re: How to edit our props.conf to assign a time field in our sample JSON event as the event timestamp?

somesoni2 — Thu, 28 Jul 2016 19:06:18 GMT

Give this a try

[vops_json]
INDEXED_EXTRACTIONS = json
NO_BINARY_CHECK = true
TIMESTAMP_FIELDS = ALERT_TIMESTAMP
TIME_PREFIX = ALERT_TIMESTAMP\"\:\s+\"
TIME_FORMAT = %s
KV_MODE = json
SHOULD_LINEMERGE = True
TRUNCATE = 0
category = Custom
description = JavaScript Object Notation format. For more information, visit http://json.org/
disabled = false
pulldown_type = true

Re: How to edit our props.conf to assign a time field in our sample JSON event as the event timestamp?

twinspop — Thu, 28 Jul 2016 19:08:01 GMT

Maybe try TIME_PREFIX as an alternate method?

[vops_json]
TIME_PREFIX = "ALERT_TIMESTAMP": "
TIME_FORMAT = %s
<the rest of your configs>

Re: How to edit our props.conf to assign a time field in our sample JSON event as the event timestamp?

rarsan_splunk — Wed, 04 Jan 2017 22:18:31 GMT

The timestamp appears to be in milliseconds, so try the following TIME_FORMAT:

INDEXED_EXTRACTIONS = json
TIMESTAMP_FIELDS = ALERT_TIMESTAMP
TIME_FORMAT=%s%3N