Getting Data In

How to specify a specific field to use as time field while indexing json data

Path Finder

I need to know how to specify to Splunk to pick a particular field in the data as Time while indexing the data. My data is in Json and looks like this:

{"report_parameters":{"venue_id":"22","timezone":"UTC","start_date":"2015-05-18 05:10:00","end_date":"2015-05-18 05:19:59","report":"items","grouping":"product","sorting":"value","filter":false,"filter_id":false,"filter2":false,"filter_id2":false,"filter3":false,"filter_id3":false},"sales_summary":{"total_orders":"0","total_sales":null,"fees_collected":null,"total_tips":null,"tax_collected":null,"average_order_size":"0.00","total_items":"0"},"report_data":[]}

All the data is in UTC.
I want to use the start_date as the Time Column.

We are using the TCP port input to push data to an index.

If I need to make change in the props.conf file what would be change I would need to make.

Esteemed Legend

As @rphillips said, you can use a configuration like this:


TIMESTAMP_FIELDS = end_date, timezone

Then put this on your forwarders and restart the Splunk instances and it should work.
Yes, I deliberately used end_date instead of start_date. Trust me: this definitely is the correct choice. If you need me to explain why, I will.

0 Karma

Splunk Employee
Splunk Employee

@tdiestel You should try using INDEXED_EXTRACTIONS = JSON in props.conf of your forwarder.


Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...