All Apps and Add-ons

Kinesis AWS Input - Timestamp recognition

Path Finder

I use kinesis heavily to pull a wide variety of logs from AWS. However I've noticed the timestamps within the logs are being ignored. Some of the events don't have timestamps and so the automatic _time is acceptable, however when my log starts with
I'd expect _time to be the same (adusted for timezone), however the AWS Add-on set _time to be 16:11:56 which appears nowhere in the log.

So it appears kinesis has some internal logic for calculating the timestamp and ignores the timestamp at the start of the log.

Has anyone else had this issue or found a solution?

0 Karma


We also use kinesis, and are pulling in vpcflow logs and recently found a solution to the log time. I will share my thoughts in hopes that it either turns out to be a solution for you or point you in the right direction.

Option 1:
This will use the current time of the splunk server to log the time of the event and convert/read epoch time.

Edit/Create a props.conf file in %SPLUNK%\etc\system\local



Option 2:
This will take either the start time of the event or end time, however you configure regexp.

Edit/Create a props.conf file in %SPLUNK%\etc\system\local

Start time of event
TIME_PREFIX = ^([^ ]+\s){10}


End time of event
TIME_PREFIX = ^([^ ]+\s){11}


Keeping in mind these are configured specifically formatted for vpc flow logs.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...