Getting Data In

Timestamp configuration in props for epoch time

Tamilraj28
Engager

Dear All,

I am getting data from the Search head in json format. The first field of the event is timestamp and it is in epoch time format("timestamp": 1609414219738696) with 16 digits.

My problem is i need to onboard data with _time value from timestamp field. So in props.conf file of Cluster master i updated as below

TIMESTAMP_FIELDS = timestamp
TIME_FORMAT = %s%6N

But the _time field is not populated properly . And i am getting 2 values in indexed data for timestamp field as below.

timestamp.PNG

Please help me on this 

Labels (5)
0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...