All Apps and Add-ons

How to use TIME_PREFIX to extract Timestamp for the JSON logs?

kiran331
Builder

How to Extract the timestamp (Date: in below screenshot) which is in UTC format and convert to CST format? current timestamp is indexing timestamp.

alt text

0 Karma

sravankaripe
Communicator

[ _json ]
BREAK_ONLY_BEFORE={"preview"
pulldown_type=true
TIME_PREFIX=\s\\"date\\":\s+\\"

0 Karma

sravankaripe
Communicator

Try this or above stanza

[ _json ]
BREAK_ONLY_BEFORE={"preview"
TIME_PREFIX=\s\\"date\\":\s+\\"
TIME_FORMAT=%Y-%m-%dT%H:%M:%S+%N:%N
TRUNCATE=9999999

0 Karma

davpx
Communicator

TIME_PREFIX = timestamp:\s+
TIME_FORMAT = %s

in props.conf

0 Karma

kiran331
Builder

I tried it din't work.

0 Karma

splunker12er
Motivator
yoursearch| eval CST_time=_time-21600| convert ctime(CST_time)|table CST_time , _time

yoursearch| eval CST_time=now()-21600| convert ctime(CST_time)|table CST_time , _time

Central Standard Time (CST) is 6 hours behind Coordinated Universal Time (UTC).
where your _time is UTC

0 Karma

kiran331
Builder

Is there a way to do it at indexing time?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!