Getting Data In

Props.conf Timestamp Not Parsing

jordanking1992
Path Finder

Hello,

We have events that are being indexed with "index time" timestamps and would like to use the timestamp from the event itself. When i upload the logs to our standalone host, splunk recognizes the timestamps from the logs and present us with the following fields for that sourcetype. (see below) However, when we deploy this to our indexers and resttart the service, events come in with the what appears to be index time timestamps. For some reason, splunk isnt recognizing the milliseconds portion of the event.

Thoughts?

alt text

[sourcetype-a]
MAX_TIMESTAMP_LOOKAHEAD = 128
TIME_PREFIX = [
TIME_FORMAT = %m/%d/%y %H:%M:%S:%N %Z
BREAK_ONLY_BEFORE = ^[\d{1,2}/\d{1,2}/\d{1,2}\s+\d{1,2}:\d{1,2}:\d{1,2}
MAX_EVENTS = 10000

0 Karma

woodcock
Esteemed Legend

Try this:

TIME_PREFIX = \[
TIME_FORMAT = %m/%d/%y %H:%M:%S:%3N %Z
MAX_TIMESTAMP_LOOKAHEAD = 25

Deploy to the first full instance of Splunk that handles the events (HF or Indexers), restart all splunk instances there, send in new events and only check those (old events will stay broken); use _index_earliest=-5m to be sure that you are looking at newly-indexed events.

0 Karma

shawnab
New Member

Try using %3N

"For GNU date-time nanoseconds. Specify any sub-second parsing by providing the width: %3N = milliseconds, %6N = microseconds, %9N = nanoseconds."

https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Configuretimestamprecognition

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...