How to write in props.conf so that the _time field takes time from the unixTime field?

[gitingua]

Hello colleagues, I would like to know

I have events where there is a unixTime field. But the _time field does not show correctly

how can I write in props.conf so that the _time field takes time from the unixTime field

[gcusello]

Hi @gitingua,

it's possible to set a props.conf to correctly read a unixtime as timestamp.

If you could share some sample of your logs, we could help you.

Ciao.

Giuseppe

[gitingua]

@gcuselloHi!


as you can see, my _time field is ahead of the unixTime field. And I would need the _time field to be the same as unixTime

i want to change my sourcetype in props.conf so that _time takes time from unixTime field

[isoutamo]

Hi

can you add some raw data inside </> block?

Some resources to use when you are onboarding data:

• https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables
• https://www.aplura.com/assets/pdf/where_to_put_props.pdf
• https://www.aplura.com/assets/pdf/props_conf_order.pdf

Basically you should configure props.conf so, that it take correct field/place from event and recognise timestamps correct. See those TIME_*  and MAX_TIMESTAMP* for found correct place. Also LINE_BREAKER needs time by time some changes.

r. Ismo