Getting Data In

Ingest events from AWS SQS but how to config timestamp field in props.conf

jerrin
Explorer

I am a newbie and I have understood basics on how to use the props.conf. But I dont find any doc on ingesting events from AWS SQS then how do I config the props.conf file to include event_timestamp as _time.

Definition says in props.conf is always based on source | sourcetype | host; correct me here if I am wrong. But in case of AWS SQS, all the 3 values are same for more than 1 index. I want this change only for 1 specific index.

Appreciate some insight

sourcetype: aws:s3:accesslogs
source: "s3://jjacob-stats/prod/*.gz"
host: ip-10-0-0-255
0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...