Getting Data In

How to recognize event time that is embedded in json string in epoch seconds?

skericsson
New Member

I'm using "From files and directories" --> "Upload and index a file" to feed the data file. The file has data in following format.

{ "_id": { "$oid": "4b97ca22729772ec85d48fc0"}, "subscriberId": "C10000235", "createTime": 1268238882453, "serviceGroup": "SGID0001", "sessionProtocolIndicator": null, "networkProxyId": "PROXY_001" }

Search shows the following basic information:
host=srinidev sourcetype=sds3 source=sds3.out

How can I get splunk (using 4.2.3) to recognize 1268238882453 as the date and use it as event time?

I added a $SPLUNK_HOME/etc/local/props.conf file with these lines:

[sds3]

TIME_PREFIX = createTime

TIME_FORMAT = %s

I also added $SPLUNK_HOME/etc/apps/search/input.conf, but with not much success.

Any help is greatly appreciated. Thanks.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

That is basically right, but first, is this all on a single Splunk instance (no forwarder)? You should try:

TIME_PREFIX = \"createTime\"\:
TIME_FORMAT = %10s%3N
MAX_TIMESTAMP_LOOKAHEAD = 15

instead of what you have above. I think the TIME_PREFIX you have should work anyway, but that the TIME_FORMAT might not be taking because %s is expecting epoch seconds, and your timestamp is milliseconds, which puts the date about 40,000 years in the future, which is outside of Splunk's default sanity limit. You might want to also try %s%3N for your TIME_FORMAT if the above doesn't work, or if you have dates either before Sep 8 2001 (9 digits) or dates after 2286.

skericsson
New Member

Thanks. Still having trouble. So is etc/apps/search/input.conf necessary. I added following lines to that file.

[monitor:///home/test/data/session_data.out]

sourcetype = sds3

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...