How to change timeformat in props.conf for a specific sourcetype?

[Simone]

Hi all,

i want to change the timestamp on event:

I want put the createDteTime on Time (yellow)

I changed the props.conf as follow:

[sourcetype]
INDEXED_EXTRACTIONS = json
TIMESTAMP_FIELDS = createdDateTime\":
TIME_FORMAT = %FT%TZ

But at the moment does not work.

Any idea?

Thanks!

[PickleRick]

1. Why are you using INDEXED_EXTRACTIONS? Why is KV_MODE=json not enough?

2. Where do you have your props.conf?

3. Your field is called createdDateTime, not createdDateTime":

[Simone]

1. Since it doesn't work without it, I tried adding INDEXED_EXTRACTIONS
2. etc\system\default
3. i tried both, it doesn't work

Thanks

[PickleRick · Accepted solution]

1. Indexed extractions are not something that should be used lightly. Unless you have a very good use case for it, you should stick to search-time extractions (aka KV_MODE=json in this case).

2a. You should _never_ touch the */default/* files! (unless you're making your own app and providing the default config for it). Your overwrites should go to the local directory.

2b. But on which component did you put those settings?

Did you adjust any other settings regarding this sourcetype? What does the btool say? (splunk btool props list <your_sourcetype> --debug)

[Simone]

You right! i have change the value directly on the app's props.conf reported the correct field and now it works.

Thanks!

[gcusello]

Hi @Simone,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[gcusello]

Hi @Simone ,

did you tried:

[sourcetype]
INDEXED_EXTRACTIONS = json
TIMESTAMP_FIELDS = createdDateTime
TIME_PREFIX =createdDateTime:\s+
TIME_FORMAT = %Y-%m-%dT%H:%M:%SZ

Ciao.

Giuseppe

[Simone]

Hi Giuseppe,

unfortunately doesn't work. The raw is the following: "createdDateTime": "2023-08-17T10:10:59Z"

i don't know if i have to change the regex