How can we override Splunk's eventtime with timestamp value present in the event data coming from JMS MQ.

[jincy_18]

I am fetching message queue message from JMS app in Splunk Enterprise 6.4.1. All the fields of the event are being extracted at indextime. I want to override the eventtime(_time) with the value present in the message(header timestamp). Please suggest how can this be achieved?

[493669 · Accepted solution]

You need to set props.conf like:
1.TIME_PREFIX = <regular expression>
2.TIME_FORMAT = <in terms of %m/%d/%Y>
TIME_PREFIX is When set, Splunk software uses the specified regular expression to looks for a match before attempting to extract a timestamp.
for ex . props.conf should look like

[<sourcetype>]
TIME_PREFIX = <regular expression>
TIME_FORMAT = %m/%d/%y

If you could share some sample events so that regular expression and TIME_FORMAT can be build as per.
reference: http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Configuretimestamprecognition

[jincy_18]

Thanks Rajesh,

Just to add on in our case the timestamp value will be an epoch value, will this pose an issue?

[493669]

Ok jincy ...so you can add below for epoch

TIME_FORMAT=%s

[493669]

%s for 10 digits

[mayurr98]

@jincy_18, so you can configure custom timestamp in the existing props.conf of JMS MQ app. Most of the parsing phase is done at indexer / HF and since timestamp recognition is at parsing phase, try setting your props in indexer/heavy forwarder

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationparametersandthedatapipeline

http://docs.splunk.com/Documentation/Splunk/lastest/Data/Configuretimestamprecognition

let me know if this helps!