Splunk Search

why splunk extracts the second timestamp instead of first

net1993
Path Finder

I investigate issue of creating too many new warm buckets and while I do that, one of the events which according to log splunkd has issues has strange problem which I am curious to find out why this happens.

The event:
fdsfds fsdf as dsfsd fdsfds fdsfds fdsfd dsfds dsf.dd

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The body of your question appears unrelated to the topic.
Where are the timestamps in your sample event? What are the props.conf settings for the event's sourcetype?

---
If this reply helps you, Karma would be appreciated.
0 Karma

net1993
Path Finder

Sorry, splunks website filters timestamps for some reason. I tried to paste it many times but its same.
Basicaly: I have 1 event with first 1 unix timestamp and then there is another timestamps with format: Y-m-d h:i:s... and splunk for some reason takes the second timestamp even thought its after the epoch timestamp which is my question why it does that. The sourcetype is default and nothing custom in it.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It sounds like the two timestamps have different formats and Splunk is finding the one that matches what is in datetime.xml. You need to override that using the props.conf settings TIME_PREFIX, TIME_FORMAT, and MAX_TIMESTAMP_LOOKAHEAD. As soon as you post examples of the timestamps we can tell you what the settings should be.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jnudell_2
Builder

Enclose your sample event in either backticks (😞
2019-08-02T00:00:00.000 timestamp1 Jan 1, 1970 00:01:02.003 timestamp2`
or code tags:
< pre> ... < /pre>
(remove the space after the opening less than sign)


2019-08-02T00:00:00.000 timestamp1 Jan 1, 1970 00:01:02.003 timestamp2

0 Karma

net1993
Path Finder

For some reason I cannot post the whole event so I place it as comment:
fdsfds fsdf as dsfsd fdsfds fdsfds fdsfd dsfds dsf.dd

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...