Getting Data In

Difficulty in Timestamp Recongnition

melonman
Motivator

Hi there,

I am trying to have splunk know the right timestamp in the following event.

COR_00000001,Com1,LOC_00000001,DC1,SUB_00000001,21F,GRP_00000001,Rack1,CON_00000001,Saving,8A0000000521A81D_1,2010/09/03,3F PW System,Powe,8A0000000521A81D_1,kWh,2010/09/03 00:00:00,15,83946325

There is a .csv file, and there are a header line at the first line and the rest of the lines are similar to the event above.

The correct timestamp is "2010/09/03 00:00:00" which is in %Y/%m/%d %H:%M:%S format.

My props.conf looks like the follwing, but I can not get the right timestamp.

[source::<path>]
CHECK_FOR_HEADER=false

[<sourcetype>]
SHOULD_LINEMERGE = False
BREAK_ONLY_BEFORE_DATE = False
TIME_FORMAT = %Y/%m/%d %H:%M:%S

Could anyone help me out?

Thanks!

Tags (1)
1 Solution

meno
Path Finder

I would first try it without TIME_FORMAT but increase:

MAX_TIMESTAMP_LOOKAHEAD = <integer>
* Specifies how far (in characters) into an event Splunk should look for a timestamp.
* Defaults to 150.

Only if the result is still bad you might continue with TIME_FORMAT.

View solution in original post

Lowell
Super Champion

I would also recommend that you add sourcetype = <sourcetype> in your [source::<path>] stanza. Otherwise you risk the wrong sourcetype association and then your TIME_FORMAT and other sourcetype-based settings will not be applied. Splunk may be getting this right on it's own, but I've found it helpful to be explicit about sourcetype associations. That's my 2 cents.

0 Karma

meno
Path Finder

I would first try it without TIME_FORMAT but increase:

MAX_TIMESTAMP_LOOKAHEAD = <integer>
* Specifies how far (in characters) into an event Splunk should look for a timestamp.
* Defaults to 150.

Only if the result is still bad you might continue with TIME_FORMAT.

melonman
Motivator

Thanks meno! it worked 🙂

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...