All Apps and Add-ons

Index time timestamp extraction from multiple field values within single event

d12harshal
Path Finder

Currently Splunk extracting timestamp from field "event_sec". Field event_sec missing sub-seconds, it only contains epoch time for date and time without milliseconds. Same raw event contains another field "event_usec", or "packet_usec" with milliseconds values.

Is it possible to concatenate field values from event_sec, and event_usec, packet_usec to extract timestamp with sub seconds?
Example: event_sec.event_usec (1523526586.184699) at index time
Fields event_usec, packet_usec contains milliseconds time, event will contains either of the fields or sometimes only event_sec will exist.

Sample event 1:
rec_type=2 event_id=12778 event_sec=1523526586 link_type=1 packet=0025b packet_len=5 packet_sec=1523526586 event_usec=184699 rec_type_desc="Packet Data" rec_type_simple=PACKET sensor=hostname

Sample event 2:
rec_type=2 event_id=12778 event_sec=1523526586 link_type=1 packet=0025b packet_len=5 packet_sec=1523526586 packet_usec=184699 rec_type_desc="Packet Data" rec_type_simple=PACKET sensor=hostname

Sample event 3:
rec_type=2 event_id=12778 event_sec=1523526586 link_type=1 packet=0025b packet_len=5 packet_sec=1523526586 rec_type_desc="Packet Data" rec_type_simple=PACKET sensor=hostname

Present index time _time field extraction: 4/12/18 4:49:46.000 AM
Required index time _time field extraction: 4/12/18 4:49:46.184 AM

I can achieve same results via search time field extraction, but I would need it from index time itself. Please help.

Existing props.conf

[source::eStreamer]
SHOULD_LINEMERGE = false
TRUNCATE = 0
TIME_PREFIX = event_sec=
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...