Getting Data In

How to edit my TIME_PREFIX in props.conf to properly extract the timestamp from my sample event?

joshualarkins
Explorer
-health_checkin_date: 2016-10-30T09:45:28.824Z

That is the line from a JSON event being sent into my Splunk instance via TCP syslog. It's being put into an index in an app I made, so I added the following the props.conf of that app:

[company_product]
TRUNCATE=0
TIME_PREFIX=\"-health_checkin_date\":\s
TIME_FORMAT=%Y-%m-%dT%T.%3N%Z
CHARSET=AUTO
KV_MODE=NONE
INDEXED_EXTRACTIONS=JSON

This stanza matches what is set in the TCP receiver as the custom sourcetype for this port, but the timestamp isn't being properly extracted. I'm intentionally prefixing the field with a hyphen so Splunk will find it quickly in the event. Am I editing the wrong props.conf?

1 Solution

lguinn2
Legend

Yes, I believe that your time prefix is incorrect. A regular expression does not need to be placed in quotation marks. Try this:

TIME_PREFIX=-health_checkin_date:\s

View solution in original post

lguinn2
Legend

Yes, I believe that your time prefix is incorrect. A regular expression does not need to be placed in quotation marks. Try this:

TIME_PREFIX=-health_checkin_date:\s

joshualarkins
Explorer
[company_product]
TRUNCATE=0
TIME_PREFIX=\"-health_checkin_date\":\"
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N
TZ=UTC
CHARSET=AUTO
KV_MODE=JSON
INDEXED_EXTRACTIONS=JSON

ended up solving it right after I posted this. I think it might be extra important to view the raw log and build the time prefix based on this, rather than attempt to guess based on the way Splunk shows JSON data all prettified.

0 Karma

joshualarkins
Explorer

... Is my TIME_PREFIX incorrect?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...