Getting Data In

How to disable overriding a timestamp from event data?

akorzun
Explorer

Hello All,

I am writing a modular input in Java. It streams events in xml format. The example:

<event>
<time>1330717125</time>
<data>timestamp=2015-05-06 08:56:06.767</data>
</event>

The timestamp from event data overrides the time from "time" element. Ho to disable it?

Tags (1)
0 Karma
1 Solution

rsennett_splunk
Splunk Employee
Splunk Employee

You might want to take a look here at some structural examples that the Master of All things Modular Inputs has done. http://blogs.splunk.com/2013/04/16/modular-inputs-tools/

Basically... when I user creates an input from your modular input, they then need to specify the sourcetype. You can set a default sourcetype, but that's kind of outside the concept of a modular input, and more an "app that streams some specific data"

Meaning... the Modular input gets the data based on the credentials etc... you provide and it streams it in. The modular input itself doesn't define what the events look like beyond the skeleton of the structure you expect... that happens in props.conf
The sourcetype would have a TIME_PREFIX= value something like:

TIME_PREFIX=\&lt;time\&gt;

Right now... with no sourcetype Splunk looks at the data, see's something marked "timestamp" and goes for that one.

So your modular input creates an inputs.conf
Unless you do it yourself, that'll be with no sourcetype
Just naming a sourcetype without creating specific attributes, will force Splunk to just do it's best to figure out what the timestamp is.
Your data basically has a sign that says "This is the timestamp!" 🙂

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

rsennett_splunk
Splunk Employee
Splunk Employee

You might want to take a look here at some structural examples that the Master of All things Modular Inputs has done. http://blogs.splunk.com/2013/04/16/modular-inputs-tools/

Basically... when I user creates an input from your modular input, they then need to specify the sourcetype. You can set a default sourcetype, but that's kind of outside the concept of a modular input, and more an "app that streams some specific data"

Meaning... the Modular input gets the data based on the credentials etc... you provide and it streams it in. The modular input itself doesn't define what the events look like beyond the skeleton of the structure you expect... that happens in props.conf
The sourcetype would have a TIME_PREFIX= value something like:

TIME_PREFIX=\&lt;time\&gt;

Right now... with no sourcetype Splunk looks at the data, see's something marked "timestamp" and goes for that one.

So your modular input creates an inputs.conf
Unless you do it yourself, that'll be with no sourcetype
Just naming a sourcetype without creating specific attributes, will force Splunk to just do it's best to figure out what the timestamp is.
Your data basically has a sign that says "This is the timestamp!" 🙂

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

akorzun
Explorer

Thank you!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...