Getting Data In
Highlighted

TIMESTAMP_FIELDS for different sources and timestamps using same sourcetype _json

Builder

Hello guys,

TIMESTAMPFIELDS must be setup in props.conf on indexers side, therefore how to use TIMESTAMPFIELDS for different sources and timestamps using same sourcetype _json? Must we define sub-sourcetypes? Is it possible and how?

First source :

[json]
TIMESTAMP
FIELDS = @timestamp
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z

Second source :

[json]
TIMESTAMP
FIELDS = @start
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z

Thanks.

0 Karma
Highlighted

Re: TIMESTAMP_FIELDS for different sources and timestamps using same sourcetype _json

SplunkTrust
SplunkTrust

Hi,

When you start splunk, splunk merges all stanza and parameters from same type of configuration file defined in various apps and system/default & system/local . When you define same parameter for same sourcetype in same configuration file (Here in your case props.conf) then precedence order will come into picture. Have a look at https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Wheretofindtheconfigurationfiles

The way you want to achieve might not possible using sourcetype but if you have different source for both the data then you can use below configuration

props.conf

[source::yourSource1]
TIMESTAMP_FIELDS = @timestamp
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z

[source::yourSource2]
TIMESTAMP_FIELDS = @start
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z 

OR you can try below config, if you want to use sourcetype but I'll not suggest to modify default sourcetype which ships with Splunk installation. Best practice is to create your own sourcetype.

props.conf

[yourSourcetype]
TIMESTAMP_FIELDS = @timestamp,@start
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z

View solution in original post

Highlighted

Re: TIMESTAMP_FIELDS for different sources and timestamps using same sourcetype _json

Builder

This works, thanks :

UF

props.conf
[metricsjson]
TIMESTAMP
FIELDS = start
TIMEFORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z
INDEXED
EXTRACTIONS = json

inputs.conf
[monitor:///VAR/logs/metrics.log]
blacklist = archives
disabled = false
index = pprapp
sourcetype = metrics
json


IDX

props.conf

[metricsjson]
TIMESTAMP
FIELDS = start
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z


SH

props.conf
[metricsjson]
KV
MODE = json

0 Karma