Getting Data In

How to specify a specific field to use as time field while indexing json data

Path Finder

I need to know how to specify to Splunk to pick a particular field in the data as Time while indexing the data. My data is in Json and looks like this:

{"report_parameters":{"venue_id":"22","timezone":"UTC","start_date":"2015-05-18 05:10:00","end_date":"2015-05-18 05:19:59","report":"items","grouping":"product","sorting":"value","filter":false,"filter_id":false,"filter2":false,"filter_id2":false,"filter3":false,"filter_id3":false},"sales_summary":{"total_orders":"0","total_sales":null,"fees_collected":null,"total_tips":null,"tax_collected":null,"average_order_size":"0.00","total_items":"0"},"report_data":[]}

All the data is in UTC.
I want to use the start_date as the Time Column.

We are using the TCP port input to push data to an index.

If I need to make change in the props.conf file what would be change I would need to make.

Esteemed Legend

As @rphillips said, you can use a configuration like this:


TIMESTAMP_FIELDS = end_date, timezone

Then put this on your forwarders and restart the Splunk instances and it should work.
Yes, I deliberately used end_date instead of start_date. Trust me: this definitely is the correct choice. If you need me to explain why, I will.

0 Karma

Splunk Employee
Splunk Employee

@tdiestel You should try using INDEXED_EXTRACTIONS = JSON in props.conf of your forwarder.


Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...