I am fetching message queue message from JMS app in Splunk Enterprise 6.4.1. All the fields of the event are being extracted at indextime. I want to override the eventtime(_time) with the value present in the message(header timestamp). Please suggest how can this be achieved?
You need to set props.conf like:
1.TIME_PREFIX = <regular expression>
2.TIME_FORMAT = <in terms of %m/%d/%Y>
TIME_PREFIX is When set, Splunk software uses the specified regular expression to looks for a match before attempting to extract a timestamp.
for ex . props.conf should look like
[<sourcetype>]
TIME_PREFIX = <regular expression>
TIME_FORMAT = %m/%d/%y
If you could share some sample events so that regular expression
and TIME_FORMAT
can be build as per.
reference: http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Configuretimestamprecognition
You need to set props.conf like:
1.TIME_PREFIX = <regular expression>
2.TIME_FORMAT = <in terms of %m/%d/%Y>
TIME_PREFIX is When set, Splunk software uses the specified regular expression to looks for a match before attempting to extract a timestamp.
for ex . props.conf should look like
[<sourcetype>]
TIME_PREFIX = <regular expression>
TIME_FORMAT = %m/%d/%y
If you could share some sample events so that regular expression
and TIME_FORMAT
can be build as per.
reference: http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Configuretimestamprecognition
Thanks Rajesh,
Just to add on in our case the timestamp value will be an epoch value, will this pose an issue?
Ok jincy ...so you can add below for epoch
TIME_FORMAT=%s
%s
for 10 digits
@jincy_18, so you can configure custom timestamp in the existing props.conf of JMS MQ app. Most of the parsing phase is done at indexer / HF and since timestamp recognition is at parsing phase, try setting your props in indexer/heavy forwarder
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationparametersandthedatapipeline
http://docs.splunk.com/Documentation/Splunk/lastest/Data/Configuretimestamprecognition
let me know if this helps!