Archive

How to import std::chrono::system_clock::now().time_since_epoch().count() as timestamp

panharry
New Member

Hello 🙂
I have an application that uses std::chrono::system_clock::now().time_since_epoch().count() as timestamp. The output is a 17 digit number like 15613916758394847. The number corresponds with the date GMT: Monday, 24. June 2019 15:54:35.839.

How can I import that timestamp into Splunk in human readable form?

Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi panharry,

First of all, please don't change datetime.xml.

There are two options for you to get this timestamp either by using props.conf to set the timestamp at parsing time or by using rex to get it by search time.

To do it at index/paring time you need to configure a props.conf for the sourcetype and options like this:

[yourSourceTypeNameHereToMatch]
TIME_FORMAT = %s%9N

This will try to match your 17 digits as timestamp in _raw, you might need to add a TIME_PREFIX and/or increase the MAX_TIMESTAMP_LOOKAHEAD options as well to get to the timestamp in the event. Please read the docs about props.conf on this.

For the search time example, please refer to this example:

| makeresults 
| eval myTime="15613916758394847", myNewTime=strptime(myTime, "%s%9N"), myNewTime2=strftime(myNewTime, "%Y-%m-%d %H:%M:%S.%9N")

the first line just creates a dummy event, the next line creates the sample timestamp and parses it into myNewTime as epoch. myNewTime2 is the human readable version of myNewTime.

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

panharry
New Member

Thanks a lot MuS 🙂
I played around already in that area.
And timestamp recognition says "%s Epoch (10 digits)" and "%9N = nanoseconds". That makes 19 digits for me and I have only 17.
But it works as you said 😄

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi panharry,

First of all, please don't change datetime.xml.

There are two options for you to get this timestamp either by using props.conf to set the timestamp at parsing time or by using rex to get it by search time.

To do it at index/paring time you need to configure a props.conf for the sourcetype and options like this:

[yourSourceTypeNameHereToMatch]
TIME_FORMAT = %s%9N

This will try to match your 17 digits as timestamp in _raw, you might need to add a TIME_PREFIX and/or increase the MAX_TIMESTAMP_LOOKAHEAD options as well to get to the timestamp in the event. Please read the docs about props.conf on this.

For the search time example, please refer to this example:

| makeresults 
| eval myTime="15613916758394847", myNewTime=strptime(myTime, "%s%9N"), myNewTime2=strftime(myNewTime, "%Y-%m-%d %H:%M:%S.%9N")

the first line just creates a dummy event, the next line creates the sample timestamp and parses it into myNewTime as epoch. myNewTime2 is the human readable version of myNewTime.

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

panharry
New Member

I read a lot of stuff in the Splunk documentation.
As far as I understood it the file "/etc/datetime.xml" is responsible to for recognition of a timestamp.
This file contains the following stanza:

    <!-- update regex before '2017' -->
<text><![CDATA[((?<=^|[\s#,"=\(\[\|\{])(?:1[012345]|9)\d{8}|^@[\da-fA-F]{16,24})(?:\.?(\d{1,6}))?(?![\d\(])]]></text>

I'm no regexp specialist but it looks like it should be positive with the above mentioned number.
Then why does the import not work like expected?

0 Karma