How to Timestamp Events

[skoelpin]

I have an index which is not timestamping the events. I looked in the Docs and it said I have to define it in my props.conf

If this is true, can someone help me with the correct stanza?

Here's what a few of my non-timestamped events look like

1451406708913 172.xx.xx.xx - 160195 98610 3.12 1.19 200 21105 0 8 /graph?node=10904&profiles=roomsOnly

1451406708879 172.xx.xx.xx - 160194 13073 4.50 3.69 200 6 0 8 /graph?node=10930

[renjith_nair · Accepted solution]

Try this

http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Configuretimestamprecognition

More read : http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/HowSplunkextractstimestamps

[jkat54]

The stanza you need to change in props.conf will be named after the sourcetype of the data.

I'm making comment on renjith.nair's response because if you read the documentation you'll understand this. However i'm also giving you the answer here:

[sourcetypeName]
TIME_PREFIX = ^
TIME_FORMAT = %s%3n

Finally, I must also note this looks like web traffic logs which splunk already has many sourcetypes preconfigured for. You might benefit more by using the IIS logs or Apache logs sourcetypes.

[skoelpin]

I read those docs before posting here.. It looks like the timestamp is being assigned to some hosts in that index and not assigning a timestamp to other hosts

How do I get a timestamp on ALL hosts?

[jkat54]

Please explain what is meant by ALL hosts?

Do you have some hosts which are sending this data in without the correct timestamps? If so check that props.conf is on every indexer and forwarder that is sending the data in, even the universal forwarders.