Getting Data In

Timestamp Parsing in JSON failed

sunallen
Engager

Can anyone help me with best configurations for timestamp parsing (where "time" is the actual time) for following JSON format :

 

{"status":0,"description":"OK","data":{"railway_bloodPressure":[{"ptt":-1.0,"sourceType":"PPG","mean":-1.0,"hr":67.0,"time":"2021-03-09 15:59:00","endTime":"2021-03-09 15:59:00","sys":124.0,"deviceId":"testing","dia":80.0},{"ptt":-1.0,"sourceType":"PPG","mean":-1.0,"hr":71.0,"time":"2021-03-09 16:09:00","endTime":"2021-03-09 16:10:00","sys":-1.0,"deviceId":"testing","dia":-1.0},{"ptt":-1.0,"sourceType":"PPG","mean":-1.0,"hr":69.0,"time":"2021-03-09 16:15:00","endTime":"2021-03-09 16:15:00","sys":127.0,"deviceId":"testing","dia":79.0},{"ptt":-1.0,"sourceType":"PPG","mean":-1.0,"hr":66.0,"time":"2021-03-09 16:25:00","endTime":"2021-03-09 16:26:00","sys":-1.0,"deviceId":"testing","dia":-1.0},{"ptt":-1.0,"sourceType":"PPG","mean":-1.0,"hr":67.0,"time":"2021-03-09 16:35:00","endTime":"2021-03-09 16:35:00","sys":125.0,"deviceId":"testing","dia":81.0},{"ptt":-1.0,"sourceType":"PPG","mean":-1.0,"hr":68.0,"time":"2021-03-09 16:45:00","endTime":"2021-03-09 16:46:00","sys":-1.0,"deviceId":"testing","dia":-1.0},{"ptt":-1.0,"sourceType":"PPG","mean":-1.0,"hr":68.0,"time":"2021-03-09 16:51:00","endTime":"2021-03-09 16:51:00","sys":127.0,"deviceId":"testing","dia":79.0}]}}

 


Imag_20210608_220622.pngImag_20210608_220627.png

I have alrady tried in props.conf...but keep failing...

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The TIME_PREFIX and TIME_FORMAT settings are incorrect.  Try these.

LINE_BREAKER = (.){"ptt
NO_BINARY_CHECK = true
TRUNCATE = 0
disabled = false
MAX_TIMESTAMP_LOOKAHEAD = 21
TIME_FORMAT = %Y-%m-%d %H:%M:%S
TIME_PREFIX = "time":"
INDEXED_EXTRACTIONS = json
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share your props.conf settings for that sourcetype.

---
If this reply helps you, Karma would be appreciated.
0 Karma

sunallen
Engager

My props.conf

DATETIME_CONFIG =
LINE_BREAKER = (.){"ptt
NO_BINARY_CHECK = true
TRUNCATE = 0
category = Custom
disabled = false
pulldown_type = 1
MAX_TIMESTAMP_LOOKAHEAD = 61
TIME_FORMAT = %Y-%m-%dT%T
TIME_PREFIX = \"time\":"(.*?)"
INDEXED_EXTRACTIONS = json
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The TIME_PREFIX and TIME_FORMAT settings are incorrect.  Try these.

LINE_BREAKER = (.){"ptt
NO_BINARY_CHECK = true
TRUNCATE = 0
disabled = false
MAX_TIMESTAMP_LOOKAHEAD = 21
TIME_FORMAT = %Y-%m-%d %H:%M:%S
TIME_PREFIX = "time":"
INDEXED_EXTRACTIONS = json
---
If this reply helps you, Karma would be appreciated.
0 Karma

sunallen
Engager

Thank you.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...