Getting Data In

Index events with timestamp of previous day

rajeshjlnt
Path Finder

We have a report from a system that needs to be indexed into splunk on monthly basis. This report is generated on 1st day of every month. 

Our requirement is to index events in this report on last day of previous month. So i want to index data from this report with timestamp of previous day.

Is this possible?

Labels (1)
0 Karma
1 Solution

rajeshjlnt
Path Finder

I added following in props.conf and transforms.conf to get the desired results,

transforms.conf

[timestamp-currenttime-oneday]
INGEST_EVAL = _time=time() - 86400

props.conf

[mysourcetype]
TRANSFORMS-gettime = timestamp-currenttime-oneday

 

 

View solution in original post

0 Karma

rajeshjlnt
Path Finder

I added following in props.conf and transforms.conf to get the desired results,

transforms.conf

[timestamp-currenttime-oneday]
INGEST_EVAL = _time=time() - 86400

props.conf

[mysourcetype]
TRANSFORMS-gettime = timestamp-currenttime-oneday

 

 

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

I'm not sure if I understood right your question, but you could get last month events by the next query:

index=_internal earliest=-1mon@mon latest=-0mon@mon
| stats earliest(_time) as eTime latest(_time) as lTime
| eval eTime = strftime(eTime, "%F %T %z"), lTime = strftime(lTime, "%F %T %z")
| table eTime lTime

To show reports day e.g. as last day of previous month just take day part of lTime (I suppose that you have events on it).

r. Ismo

0 Karma

rajeshjlnt
Path Finder

Thanks for your response @isoutamo , but my question is to manipulate timestamp during indexing events.

During event indexing there are settings in sourcetype like Auto, Current, Advanced and Configuration file. I would like to know if there is a way to set timestamp to be (current time - 1 day)

0 Karma

isoutamo
SplunkTrust
SplunkTrust
I haven't try this but there is INGEST_EVAL on transforms.conf (https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Transformsconf) which can help you.
r. Ismo

rajeshjlnt
Path Finder

thanks @isoutamo for showing right direction

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!