Hello all,
Suppose I index JSON objects into Splunk and that each of these objectst has a timestamp key. What input should there be in the props.conf file in order for Splunk to automatically configure the default timestamp field to the previous mentioned JSON key ?
Thanks
Hello
then you need to use:
TIME_PREFIX=stats_time\s:\s
TIME_FORMAT=%s
Try it and let me know if it worked
Hello
then you need to use:
TIME_PREFIX=stats_time\s:\s
TIME_FORMAT=%s
Try it and let me know if it worked
What field?
Try _time field instead
Or look at the timestamp located at the left side of the event in the flashtimeline view
Unfortunately I still see that the timestamp field gets filled with 'none' only .
Indexed events look like this:
{
name : "PA",
id : "5",
........
stats_time : 1386940477673,
........
type : "Port"
}
"stats_time" is the key that I'm interested in to be rolled into the timestamp default field.
Please include a sample event