Getting Data In

How to extract timestamp for JSON events with no date/time?

jwalzerpitt
Influencer

I have a flat file that is in JSON format where events have no date/time as follows:

 

 

{"device": "info.gw.xyz.com", "ip": "x.x.x.x", "age": "0", "mac": "Incomplete", "interface": " "}, {"device": "info.gw.xyz.com", "ip": "x.x.x.x", "age": "-", "mac": "0000.0000.0000", "interface": "Vlan673"}

 

 

My props.conf file is as follows:

 

 

[my_arp]
INDEXED_EXTRACTIONS = JSON
TZ=UTC

 

 

Problem is when I search events, they are four hours in the future.

The files are on a sever that has the UF and that has the correct time set so looking through the Splunk docs  (https://docs.splunk.com/Documentation/Splunk/9.0.1/Data/HowSplunkextractstimestamps) I see this:

  • If no events in the source have a date, Splunk software tries to find a date in the source name or file name. The events must have a time, even if they don't have a date.

The files do have a date and time

How do I fix this?

Thx

Labels (1)
Tags (2)
0 Karma

jwalzerpitt
Influencer

Verified with Splunk support that setting the time zone in props in combination with setting time zone preference in GUI is correct

0 Karma

jwalzerpitt
Influencer

So just checked preferences for my account in Splunk Cloud and no default was set so I changed that to GMT/Eastern Time and now when I search the events they have the correct time.

Just making sure this is the fix

0 Karma

somesoni2
Revered Legend

Yes. The data is being logged in GMT/UTC as you specified in props.conf. The _time (or Time column) in search result is translated event time based on current user's timezone (so if you're TZ before UTC, events will show in future). If you want to see the time in the same timezone where they occurred, then what you did is correct (changing your timezone to match data timezone).

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...