Getting Data In

Change timestamp of input data during indexing

ashabc
Contributor

I have a simple file that is generated by a script for which I do not have a control. The content of the file is like below

{
  "total": 15615
}
{
  "limit": 32250
}

Splunk can parse data well using sourcetype=json_no_timestamp
As a default the timestamp for the indexed data is the current system time

Is there a way I can modify the date time for this particular input (I am using file monitor)? I would like the date stamp to be 1 day behind than the current system time, as data in the file actually represents yesterday's information and not today's.

0 Karma
1 Solution

sbbadri
Motivator

@ashabc
try this,

you need to do this in the indexer

props.conf

[your sourcetypename]
EVAL-newDate = _time
EVAL-newDate1 = newDate - 86400
EVAL-_time = strftime(newDate1,"%Y-%m-%d %H:%M:%S")

I hope this helps

View solution in original post

0 Karma

sbbadri
Motivator

@ashabc
try this,

you need to do this in the indexer

props.conf

[your sourcetypename]
EVAL-newDate = _time
EVAL-newDate1 = newDate - 86400
EVAL-_time = strftime(newDate1,"%Y-%m-%d %H:%M:%S")

I hope this helps

0 Karma

ashabc
Contributor

Thank you so much for such a prompt response. I tried this in props.conf, and it appears that splunk does not recognise time format any more after applying this conversion in props.conf for this sourcetype

Could this be because of strftime converts timestamp to string?

0 Karma

ashabc
Contributor

Actually I got it working using a search time modifier

eval _time=_time-86400

Thank you for pointing me to the right direction.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...