Getting Data In
Highlighted

Configure Timestamp field

Path Finder

Hello all,

Suppose I index JSON objects into Splunk and that each of these objectst has a timestamp key. What input should there be in the props.conf file in order for Splunk to automatically configure the default timestamp field to the previous mentioned JSON key ?

Thanks

Highlighted

Re: Configure Timestamp field

Motivator

Please include a sample event

0 Karma
Highlighted

Re: Configure Timestamp field

Path Finder

Indexed events look like this:

{
name : "PA",
id : "5",
........
stats_time : 1386940477673,
........
type : "Port"
}

"stats_time" is the key that I'm interested in to be rolled into the timestamp default field.

0 Karma
Highlighted

Re: Configure Timestamp field

Motivator

Hello

then you need to use:

TIME_PREFIX=stats_time\s:\s
TIME_FORMAT=%s

Try it and let me know if it worked

View solution in original post

Highlighted

Re: Configure Timestamp field

Path Finder

Unfortunately I still see that the timestamp field gets filled with 'none' only .

0 Karma
Highlighted

Re: Configure Timestamp field

Motivator

What field?

Try _time field instead

Or look at the timestamp located at the left side of the event in the flashtimeline view