I'm using "From files and directories" --> "Upload and index a file" to feed the data file. The file has data in following format.
{ "_id": { "$oid": "4b97ca22729772ec85d48fc0"}, "subscriberId": "C10000235", "createTime": 1268238882453, "serviceGroup": "SGID0001", "sessionProtocolIndicator": null, "networkProxyId": "PROXY_001" }
Search shows the following basic information:
host=srinidev sourcetype=sds3 source=sds3.out
How can I get splunk (using 4.2.3) to recognize 1268238882453 as the date and use it as event time?
I added a $SPLUNK_HOME/etc/local/props.conf file with these lines:
[sds3]
TIME_PREFIX = createTime
TIME_FORMAT = %s
I also added $SPLUNK_HOME/etc/apps/search/input.conf, but with not much success.
Any help is greatly appreciated. Thanks.
That is basically right, but first, is this all on a single Splunk instance (no forwarder)? You should try:
TIME_PREFIX = \"createTime\"\:
TIME_FORMAT = %10s%3N
MAX_TIMESTAMP_LOOKAHEAD = 15
instead of what you have above. I think the TIME_PREFIX
you have should work anyway, but that the TIME_FORMAT
might not be taking because %s
is expecting epoch seconds, and your timestamp is milliseconds, which puts the date about 40,000 years in the future, which is outside of Splunk's default sanity limit. You might want to also try %s%3N
for your TIME_FORMAT
if the above doesn't work, or if you have dates either before Sep 8 2001 (9 digits) or dates after 2286.
Thanks. Still having trouble. So is etc/apps/search/input.conf necessary. I added following lines to that file.
[monitor:///home/test/data/session_data.out]
sourcetype = sds3