Deployment Architecture

time indexing not correct

splunksurekha
Path Finder

alt text

Hi attached is the image which shows there is a difference in the Time field and the actual time which comes from the input file getting indexed with column name alertdate.
so that means the index time and alertdate are not in sync which is incorrect right . Can you help me here.

I am using below configuration.
props.conf
[zbxAlertReport]
SHOULD_LINEMERGE = false
INDEXED_EXTRACTIONS = csv
FIELD_DELIMITER = ,
FIELD_NAMES = alerthost,hostname,alertname,alertstatus,alertseverity,alertdate
TIMESTAMP_FIELDS = date
TIME_FORMAT = %a%b%d%H:%M:%S%Y
category = Structured
MAX_TIMESTAMP_LOOKAHEAD = 500

transforms.conf
[zbxAlertReport]
filename = ZbxDailyReport.csv

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk isn't finding a timestamp that matches the specified criteria so it's using current time. Making the following changes should fix it.

The TIMESTAMP_FIELDS value is "date", but there is no such field in the event. Perhaps it should be "alertdate".
The TIME_FORMAT value looks like it doesn't match the data in the alertdate field. Try TIME_FORMAT = %a %b %d %H:%M:%S %Y.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...