Getting Data In

Parsing timestamp that is relative from zero from an embedded device

WiredBob
Engager

Hi

I'm new to Splunk and have what I think is a strange use case (maybe not!). We are capturing logs from an embedded device without a battery powered clock and therefore when booted the device has no reference to the current time. It generates logs from a time of 0 and timestamps the log events with a time offset in . e.g. 9.307.

The device does generally get a time reference quite soon after boot from NTP (if network connected) in the log, so I could pre-process the logs, parse out the time and write a valid timestamp for each event by recalculating the offset.

Does anyone have any recommendations?

Thanks

Robert

dwaddle
SplunkTrust
SplunkTrust

In this case, I would probably use DATETIME_CONFIG=CURRENT and just let the indexed time of the event be close enough... I am assuming you are forwarding these over the network, and they will arrive at the indexer within a few milliseconds of being created on the embedded device. If not, this will not work.

0 Karma

lukejadamec
Super Champion

You need a reference time - any time source will do according to its accuracy. Without a reference time you're out of luck. You need a reference time.

0 Karma

WiredBob
Engager

Thanks for the suggestion, but unfortunately these are logs we pull off the device periodically, not passed in near-real time across the network

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...