Getting Data In

How can we override Splunk's eventtime with timestamp value present in the event data coming from JMS MQ.

jincy_18
Path Finder

I am fetching message queue message from JMS app in Splunk Enterprise 6.4.1. All the fields of the event are being extracted at indextime. I want to override the eventtime(_time) with the value present in the message(header timestamp). Please suggest how can this be achieved?

1 Solution

493669
Super Champion

You need to set props.conf like:
1.TIME_PREFIX = <regular expression>
2.TIME_FORMAT = <in terms of %m/%d/%Y>
TIME_PREFIX is When set, Splunk software uses the specified regular expression to looks for a match before attempting to extract a timestamp.
for ex . props.conf should look like

[<sourcetype>]
TIME_PREFIX = <regular expression>
TIME_FORMAT = %m/%d/%y

If you could share some sample events so that regular expression and TIME_FORMAT can be build as per.
reference: http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Configuretimestamprecognition

View solution in original post

0 Karma

493669
Super Champion

You need to set props.conf like:
1.TIME_PREFIX = <regular expression>
2.TIME_FORMAT = <in terms of %m/%d/%Y>
TIME_PREFIX is When set, Splunk software uses the specified regular expression to looks for a match before attempting to extract a timestamp.
for ex . props.conf should look like

[<sourcetype>]
TIME_PREFIX = <regular expression>
TIME_FORMAT = %m/%d/%y

If you could share some sample events so that regular expression and TIME_FORMAT can be build as per.
reference: http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Configuretimestamprecognition

0 Karma

jincy_18
Path Finder

Thanks Rajesh,

Just to add on in our case the timestamp value will be an epoch value, will this pose an issue?

0 Karma

493669
Super Champion

Ok jincy ...so you can add below for epoch

TIME_FORMAT=%s
0 Karma

493669
Super Champion

%s for 10 digits

0 Karma

mayurr98
Super Champion

@jincy_18, so you can configure custom timestamp in the existing props.conf of JMS MQ app. Most of the parsing phase is done at indexer / HF and since timestamp recognition is at parsing phase, try setting your props in indexer/heavy forwarder

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationparametersandthedatapipeline

http://docs.splunk.com/Documentation/Splunk/lastest/Data/Configuretimestamprecognition

let me know if this helps!

0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...