Getting Data In

Timestamp help

rakesh_498115
Motivator

Hi

I have two time stamps in my logs. .

say and TIMESTAMP=2012-07-11T06:59:00.008+01:00 ..

How can i say splunk to take one of time as _time . i need the TIMESTAMP to be taken as my loggig event time..so that i can calucate the difference between the events with the help of transacition command...

Please help..

Tags (1)
0 Karma
1 Solution

Ayn
Legend

You need to set the TIME_PREFIX in props.conf.

[yoursourcetype]
TIME_PREFIX = TIMESTAMP=

http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf

View solution in original post

0 Karma

Ayn
Legend

You need to set the TIME_PREFIX in props.conf.

[yoursourcetype]
TIME_PREFIX = TIMESTAMP=

http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...