Getting Data In

Getting metrics timestamp in future

nazar554
Loves-to-Learn

Hello, I am trying to get metrics from RouterOS using scripting (logs are forwarded using UDP)

I end up with all timestamps 3 hours in the future (tried adding TZ = GMT, didn't help)

I created a custom format like this: `script, debug <TIMESTAMP> metric_name=firewall_rule <OTHER.DIMS..> packets=100 bytes = 11`

Example:

script, debug aug/01/2020 17:35:14 +03:00:00 metric_name=firewall_rule rule=dummy bytes=12345 packet=40

I also tried doing

 

| makeresults | eval test=strptime("aug/01/2020 17:35:14 +03:00:00", "%b/%d/%Y %T %::z")

 

And I get correct UNIX timestamp in query results

transforms.conf

 

 

[metric-schema:log2metrics_mikrotik_keyvalue]
METRIC-SCHEMA-MEASURES-firewall_rule = packets, bytes

 

 

props.conf

 

 

[log2metrics_mikrotik_keyvalue]
DATETIME_CONFIG = 
LINE_BREAKER = ([\r\n]+)
METRIC-SCHEMA-TRANSFORMS = metric-schema:log2metrics_mikrotik_keyvalue
NO_BINARY_CHECK = true
TRANSFORMS-EXTRACT = field_extraction
category = Metrics
pulldown_type = 1
# RouterOS
# mmm/dd/yyyy HH:MM:SS [+-]TZHH:TZMM:TZSS
TIME_FORMAT = %b/%d/%Y %T %::z
TZ = GMT
disabled = false
SHOULD_LINEMERGE = false
BREAK_ONLY_BEFORE_DATE = 
PREAMBLE_REGEX = script,debug 

 

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...