Deployment Architecture

time indexing not correct

splunksurekha
Path Finder

alt text

Hi attached is the image which shows there is a difference in the Time field and the actual time which comes from the input file getting indexed with column name alertdate.
so that means the index time and alertdate are not in sync which is incorrect right . Can you help me here.

I am using below configuration.
props.conf
[zbxAlertReport]
SHOULD_LINEMERGE = false
INDEXED_EXTRACTIONS = csv
FIELD_DELIMITER = ,
FIELD_NAMES = alerthost,hostname,alertname,alertstatus,alertseverity,alertdate
TIMESTAMP_FIELDS = date
TIME_FORMAT = %a%b%d%H:%M:%S%Y
category = Structured
MAX_TIMESTAMP_LOOKAHEAD = 500

transforms.conf
[zbxAlertReport]
filename = ZbxDailyReport.csv

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk isn't finding a timestamp that matches the specified criteria so it's using current time. Making the following changes should fix it.

The TIMESTAMP_FIELDS value is "date", but there is no such field in the event. Perhaps it should be "alertdate".
The TIME_FORMAT value looks like it doesn't match the data in the alertdate field. Try TIME_FORMAT = %a %b %d %H:%M:%S %Y.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...