How to set the _time in SC4S events to the current time/time event was recieved?

[davidoff96]

Some data would be mistagged as a different time zone, or would come in very late and would miss our alarms, since the _time was set in the past. Management also prefers our _time be essentially index time. How would I set that?

The following does NOT work in compliance_meta_by_source.csv:

f_name,.splunk._time,${R_UNIXTIME}

f_name,.splunk.time,${R_UNIXTIME}

f_name,.fields.time,${R_UNIXTIME}

f_name,.fields._time,${R_UNIXTIME}

[davidoff96 · Accepted solution]

Answering my own question, mostly in case I need to do this again in the future:

You can make sc4s set the _time to R_UNIXTIME (aka, the time syslog-ng actually recieved the event) by adding the following to the compliance_meta_by_source.csv file:

f_name,.netsource.sc4s_use_recv_time,"yes"

Explanation:

I noticed that you could do this because I cloned the repo, desperate for any sort of help I could get. In the project, you can find this funny little line tucked away:

Which apparently, though not documented anywhere I'm aware of, controls whether an event has the _time set to the time syslog-ng "guesses", or the time the event came in. I tested it on a noisy source, and you can see here that R_UNIXTIME and _time are the same:

In this example, test_time_stamp was hard coded to be R_UNIXTIME, and test_time_stamp_actual was evaled to be the event _time.

So the issue was with Dell Avamar specifically, so I did the following in compliance_meta_by_source.conf:

And the following in compliance_meta_by_source.csv:

Wanted to post this because I have had almost 0 luck with the documentation for sc4s in the past. Here's to any future sc4s spelunkers