How to get the indexed stamp in the splunk logs

[rishma]

Hi,

I have logs format like :
{"guid": "ABC", "type": "email", "value": "email", "session": "sessioid", "service": "HTTP", "created": "2019-11-07T22:41:28.682+00:00", "remote_host": "ip"}

I want to get the timestamp for indexing based on "created" field and want tp show it during search results under _time.

I used the below props.conf :
[sourcetype]
TIME_PREFIX = "created":\s"
KV_MODE=JSON
INDEXED_EXTRACTIONS=JSON
TZ=UTC
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%z
MAX_TIMESTAMP_LOOKAHEAD = 1000

But its not working. Please guide.

Thanks,

[manjunathmeti]

You can try just using TIMESTAMP_FIELDS, ignore other attributes (TIME_PREFIX, TZ, TIME_FORMAT, MAX_TIMESTAMP_LOOKAHEAD). And also attribute KV_MODE is not required during indexed time field extractions.

[sourcetype]
INDEXED_EXTRACTIONS = json
KV_MODE = none
TIMESTAMP_FIELDS = created

[rishma]

Tried this too. But same response.

[rishma]

Tried changing the entries to :

TIME_PREFIX=\"created\":\s\"
KV_MODE=JSON
INDEXED_EXTRACTIONS=JSON
TZ=UTC
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%:z
MAX_TIMESTAMP_LOOKAHEAD = 100

as well as :

TIME_PREFIX="created":\s"
KV_MODE=JSON
INDEXED_EXTRACTIONS=JSON
TZ=UTC
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%:z
MAX_TIMESTAMP_LOOKAHEAD = 100

and

TIME_PREFIX=\"created\":\s\"
KV_MODE=JSON
INDEXED_EXTRACTIONS=JSON
TZ=UTC
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%z
MAX_TIMESTAMP_LOOKAHEAD = 100

None of the above worked.

[richgalloway]

Try TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%:z

[rishma]

Tried it. But same response.

[dflodstrom]

Have you tried escaping the quotation marks in your TIME_PREFIX ?

TIME_PREFIX = \"created\":\s\"

[rishma]

Tried it. Same response.