Getting Data In

How can we override Splunk's eventtime with timestamp value present in the event data coming from JMS MQ.

jincy_18
Path Finder

I am fetching message queue message from JMS app in Splunk Enterprise 6.4.1. All the fields of the event are being extracted at indextime. I want to override the eventtime(_time) with the value present in the message(header timestamp). Please suggest how can this be achieved?

1 Solution

493669
Super Champion

You need to set props.conf like:
1.TIME_PREFIX = <regular expression>
2.TIME_FORMAT = <in terms of %m/%d/%Y>
TIME_PREFIX is When set, Splunk software uses the specified regular expression to looks for a match before attempting to extract a timestamp.
for ex . props.conf should look like

[<sourcetype>]
TIME_PREFIX = <regular expression>
TIME_FORMAT = %m/%d/%y

If you could share some sample events so that regular expression and TIME_FORMAT can be build as per.
reference: http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Configuretimestamprecognition

View solution in original post

0 Karma

493669
Super Champion

You need to set props.conf like:
1.TIME_PREFIX = <regular expression>
2.TIME_FORMAT = <in terms of %m/%d/%Y>
TIME_PREFIX is When set, Splunk software uses the specified regular expression to looks for a match before attempting to extract a timestamp.
for ex . props.conf should look like

[<sourcetype>]
TIME_PREFIX = <regular expression>
TIME_FORMAT = %m/%d/%y

If you could share some sample events so that regular expression and TIME_FORMAT can be build as per.
reference: http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Configuretimestamprecognition

0 Karma

jincy_18
Path Finder

Thanks Rajesh,

Just to add on in our case the timestamp value will be an epoch value, will this pose an issue?

0 Karma

493669
Super Champion

Ok jincy ...so you can add below for epoch

TIME_FORMAT=%s
0 Karma

493669
Super Champion

%s for 10 digits

0 Karma

mayurr98
Super Champion

@jincy_18, so you can configure custom timestamp in the existing props.conf of JMS MQ app. Most of the parsing phase is done at indexer / HF and since timestamp recognition is at parsing phase, try setting your props in indexer/heavy forwarder

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationparametersandthedatapipeline

http://docs.splunk.com/Documentation/Splunk/lastest/Data/Configuretimestamprecognition

let me know if this helps!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...