Getting Data In

[HEC] timestamp recognition

sylim_splunk
Splunk Employee
Splunk Employee

We have data ingesting into Splunk via HEC token, and observed the time parsing of the event is not taking properly.
Example - In the event the timestamp looks like 2020-12-01 09:59:18.0674, but in the Splunk it was capturing 12/1/20 9:59:18.000 AM. Here missing the millisecond in the Splunk time but it's not limited to the millisecond.. sometimes the second field are not correct..

We tried applying the time format and time prefix for the source and sourcetype as below, but it is not fixing the issue.
TIME_PREFIX = "Date": "
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%4N

And also tried the props.conf below;

[the_sourcetype]
AUTO_KV_JSON = false
INDEXED_EXTRACTIONS = json
TIMESTAMP_FIELDS = Date

We use collector/event REST endpoint.

Splunk version 7.2.8.

Labels (1)
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

With 7.2.8 must use collector/raw, not collector/event to recognize timestamp in the payload.

Ver 8.0 with auto_extract_timestamp has been implemented for collector/event
The timestamp recognition issue of this case happened as it's not using collector/raw endpoint.
https://docs.splunk.com/Documentation/Splunk/latest/Data/FormateventsforHTTPEventCollector#Raw_event...

i) Use 'collector/raw' endpoint then it will detect a correct timestamp. 

ii) Upgrade Splunk to 8.0 or above and use auto_extract_timestamp=true with "collector/event".

for example, in 8.0+
$ curl -k http://localhost:8088/services/collector/event?auto_extract_timestamp=true -H "Authorization: Splunk <TOKEN>" -H "content-Type: application/json" -d '{"event": "2020-12-16 00:00:00 Hellow world"}'

View solution in original post

sylim_splunk
Splunk Employee
Splunk Employee

With 7.2.8 must use collector/raw, not collector/event to recognize timestamp in the payload.

Ver 8.0 with auto_extract_timestamp has been implemented for collector/event
The timestamp recognition issue of this case happened as it's not using collector/raw endpoint.
https://docs.splunk.com/Documentation/Splunk/latest/Data/FormateventsforHTTPEventCollector#Raw_event...

i) Use 'collector/raw' endpoint then it will detect a correct timestamp. 

ii) Upgrade Splunk to 8.0 or above and use auto_extract_timestamp=true with "collector/event".

for example, in 8.0+
$ curl -k http://localhost:8088/services/collector/event?auto_extract_timestamp=true -H "Authorization: Splunk <TOKEN>" -H "content-Type: application/json" -d '{"event": "2020-12-16 00:00:00 Hellow world"}'

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...