Getting Data In

How to specify a specific field to use as time field while indexing json data

Path Finder

I need to know how to specify to Splunk to pick a particular field in the data as Time while indexing the data. My data is in Json and looks like this:

{"report_parameters":{"venue_id":"22","timezone":"UTC","start_date":"2015-05-18 05:10:00","end_date":"2015-05-18 05:19:59","report":"items","grouping":"product","sorting":"value","filter":false,"filter_id":false,"filter2":false,"filter_id2":false,"filter3":false,"filter_id3":false},"sales_summary":{"total_orders":"0","total_sales":null,"fees_collected":null,"total_tips":null,"tax_collected":null,"average_order_size":"0.00","total_items":"0"},"report_data":[]}

All the data is in UTC.
I want to use the start_date as the Time Column.

We are using the TCP port input to push data to an index.

If I need to make change in the props.conf file what would be change I would need to make.

Esteemed Legend

As @rphillips said, you can use a configuration like this:


TIMESTAMP_FIELDS = end_date, timezone

Then put this on your forwarders and restart the Splunk instances and it should work.
Yes, I deliberately used end_date instead of start_date. Trust me: this definitely is the correct choice. If you need me to explain why, I will.

0 Karma

Splunk Employee
Splunk Employee

@tdiestel You should try using INDEXED_EXTRACTIONS = JSON in props.conf of your forwarder.


Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...