Getting Data In

How to disable overriding a timestamp from event data?

akorzun
Explorer

Hello All,

I am writing a modular input in Java. It streams events in xml format. The example:

<event>
<time>1330717125</time>
<data>timestamp=2015-05-06 08:56:06.767</data>
</event>

The timestamp from event data overrides the time from "time" element. Ho to disable it?

Tags (1)
0 Karma
1 Solution

rsennett_splunk
Splunk Employee
Splunk Employee

You might want to take a look here at some structural examples that the Master of All things Modular Inputs has done. http://blogs.splunk.com/2013/04/16/modular-inputs-tools/

Basically... when I user creates an input from your modular input, they then need to specify the sourcetype. You can set a default sourcetype, but that's kind of outside the concept of a modular input, and more an "app that streams some specific data"

Meaning... the Modular input gets the data based on the credentials etc... you provide and it streams it in. The modular input itself doesn't define what the events look like beyond the skeleton of the structure you expect... that happens in props.conf
The sourcetype would have a TIME_PREFIX= value something like:

TIME_PREFIX=\&lt;time\&gt;

Right now... with no sourcetype Splunk looks at the data, see's something marked "timestamp" and goes for that one.

So your modular input creates an inputs.conf
Unless you do it yourself, that'll be with no sourcetype
Just naming a sourcetype without creating specific attributes, will force Splunk to just do it's best to figure out what the timestamp is.
Your data basically has a sign that says "This is the timestamp!" 🙂

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

rsennett_splunk
Splunk Employee
Splunk Employee

You might want to take a look here at some structural examples that the Master of All things Modular Inputs has done. http://blogs.splunk.com/2013/04/16/modular-inputs-tools/

Basically... when I user creates an input from your modular input, they then need to specify the sourcetype. You can set a default sourcetype, but that's kind of outside the concept of a modular input, and more an "app that streams some specific data"

Meaning... the Modular input gets the data based on the credentials etc... you provide and it streams it in. The modular input itself doesn't define what the events look like beyond the skeleton of the structure you expect... that happens in props.conf
The sourcetype would have a TIME_PREFIX= value something like:

TIME_PREFIX=\&lt;time\&gt;

Right now... with no sourcetype Splunk looks at the data, see's something marked "timestamp" and goes for that one.

So your modular input creates an inputs.conf
Unless you do it yourself, that'll be with no sourcetype
Just naming a sourcetype without creating specific attributes, will force Splunk to just do it's best to figure out what the timestamp is.
Your data basically has a sign that says "This is the timestamp!" 🙂

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

akorzun
Explorer

Thank you!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...