Getting Data In

How to change timeformat in props.conf for a specific sourcetype?

Simone
Explorer

Hi all,

i want to change the timestamp on event:

Simone_0-1692262979119.png

I want put the createDteTime on Time (yellow)

I changed the props.conf as follow:

 

 

[sourcetype]
INDEXED_EXTRACTIONS = json
TIMESTAMP_FIELDS = createdDateTime\":
TIME_FORMAT = %FT%TZ

 

 


But at the moment does not work.

Any idea?

Thanks!

Labels (2)
Tags (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

1. Indexed extractions are not something that should be used lightly. Unless you have a very good use case for it, you should stick to search-time extractions (aka KV_MODE=json in this case).

2a. You should _never_ touch the */default/* files! (unless you're making your own app and providing the default config for it). Your overwrites should go to the local directory.

2b. But on which component did you put those settings?

Did you adjust any other settings regarding this sourcetype? What does the btool say? (splunk btool props list <your_sourcetype> --debug)

 

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

1. Why are you using INDEXED_EXTRACTIONS? Why is KV_MODE=json not enough?

2. Where do you have your props.conf?

3. Your field is called createdDateTime, not createdDateTime":

0 Karma

Simone
Explorer
  1. Since it doesn't work without it, I tried adding INDEXED_EXTRACTIONS
  2. etc\system\default
  3. i tried both, it doesn't work

Thanks

0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. Indexed extractions are not something that should be used lightly. Unless you have a very good use case for it, you should stick to search-time extractions (aka KV_MODE=json in this case).

2a. You should _never_ touch the */default/* files! (unless you're making your own app and providing the default config for it). Your overwrites should go to the local directory.

2b. But on which component did you put those settings?

Did you adjust any other settings regarding this sourcetype? What does the btool say? (splunk btool props list <your_sourcetype> --debug)

 

Simone
Explorer

You right! i have change the value directly on the app's props.conf reported the correct field and now it works.

Thanks!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Simone,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Simone ,

did you tried:

[sourcetype]
INDEXED_EXTRACTIONS = json
TIMESTAMP_FIELDS = createdDateTime
TIME_PREFIX =createdDateTime:\s+
TIME_FORMAT = %Y-%m-%dT%H:%M:%SZ

Ciao.

Giuseppe

0 Karma

Simone
Explorer

Hi Giuseppe,

unfortunately doesn't work. The raw is the following: "createdDateTime": "2023-08-17T10:10:59Z"

i don't know if i have to change the regex

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...