TIMESTAMP_FIELDS for different sources and timestamps using same sourcetype _json

[splunkreal]

Hello guys,

TIMESTAMP_FIELDS must be setup in props.conf on indexers side, therefore how to use TIMESTAMP_FIELDS for different sources and timestamps using same sourcetype _json? Must we define sub-sourcetypes? Is it possible and how?

First source :

[_json]
TIMESTAMP_FIELDS = @timestamp
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z

Second source :

[_json]
TIMESTAMP_FIELDS = @start
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z

Thanks.

[splunkreal]

This works, thanks :

UF

props.conf
[metrics_json]
TIMESTAMP_FIELDS = start
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z
INDEXED_EXTRACTIONS = json

inputs.conf
[monitor:///VAR/logs/metrics.log]
blacklist = archives
disabled = false
index = ppr_app
sourcetype = metrics_json

---

IDX

props.conf

[metrics_json]
TIMESTAMP_FIELDS = start
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z

---

SH

props.conf
[metrics_json]
KV_MODE = json

[harsmarvania57 · Accepted solution]

Hi,

When you start splunk, splunk merges all stanza and parameters from same type of configuration file defined in various apps and system/default & system/local . When you define same parameter for same sourcetype in same configuration file (Here in your case props.conf) then precedence order will come into picture. Have a look at https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Wheretofindtheconfigurationfiles

The way you want to achieve might not possible using sourcetype but if you have different source for both the data then you can use below configuration

props.conf

[source::yourSource1]
TIMESTAMP_FIELDS = @timestamp
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z

[source::yourSource2]
TIMESTAMP_FIELDS = @start
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z 

OR you can try below config, if you want to use sourcetype but I'll not suggest to modify default sourcetype which ships with Splunk installation. Best practice is to create your own sourcetype.

props.conf

[yourSourcetype]
TIMESTAMP_FIELDS = @timestamp,@start
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z