Getting Data In

How to generate a proper timestamp on events?

dominiquevocat
SplunkTrust
SplunkTrust

I have data where i get a date/timestamp as a string and an offset as a string from some API.

I manage to generate the _time field and it shows properly in the event view and stuff like time based drilldown (plus minus n seconds) works.

However only the field _time is available on the event and the date_hour etc fields do not show up, thus timechart etc won't work.

I tried to generate the timestamp subfields and append them to the event but they are not visible in Splunk.

What do i need to take care of to get proper events with a proper timestamp?

0 Karma
1 Solution

dominiquevocat
SplunkTrust
SplunkTrust

Just return _time as epoch.

View solution in original post

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

Just return _time as epoch.

0 Karma

niketn
Legend

One of the crude options in our case would be to overwrite _time with field_time. Provided field_time is time stored in string format. PS: The time format below is assuming string date time string is in YYYY/MM/DD HH:MM:SS format. You can use your own time formatting based on your exiisting field_time values.
| eval _time= strptime(field_time,"%Y/%m/%d %H:%M:S") | timechart ...

If field_time contains epoch time and not string time then direct assignment should work:
** | eval _time=field_time | timechart **...

Since identification of exact time for various event is most crucial for Splunk, ideally, _time should be parsed and identified directly during data ingestion for optimal performance and accurate results. Any modifications to _time field afterwards may lead to unwanted results and issues.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

doh'

if i just send it as epoch its fine. Erm.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...