Getting Data In

Use JSON epoch date time instead of index time

Path Finder

I have a JSON that is for emails like the following:

{   [-] 
     computer:  {   [+] 
    }   
     date:   2018-03-08T11:42:57+00:00      
     event_type_id:  553648152  
     timestamp:  1520509377 
     timestamp_nanoseconds:  893334279  
}

Note: the time above is in UTC.

However, my time is set to PST and so it looks like I'm getting the index time, timestamp of "11/14/17 6:50:49.000 PM"

This is what's in my props.conf:

[cisco:amp:json]
SHOULD_LINEMERGE = true
pulldown_type = 1
category = Splunk App Add-on Builder
LINE_BREAKER = ([\r\n]*)\{\"event_type\"\:
TIME_PREFIX = timestamp:\s*
TIME_FORMAT = %s
KV_MODE = json
TRANSFORMS-amp_hostname = force_amp_hostname
EXTRACT-amp_hostname = \"hostname\"\:\s*\"(?<dest>[^\"]*)
EXTRACT-amp_file_name = \"file_name\"\:\s*\"(?<file_name>[^\"]*)
EXTRACT-amp_file_path = \"file_path\"\:\s*\"(?<file_path>[^\"]*)
EXTRACT-amp_user = \"user\"\:\s?\"(?<user>[^\"]+)
EVAL-signature =
EVAL-action =
EVAL-file_hash =
BREAK_ONLY_BEFORE = ([\r\n]*)\{\"event_type\"\:
DATETIME_CONFIG =
NO_BINARY_CHECK = true
disabled = false
INDEXED_EXTRACTIONS = json
0 Karma

Influencer

in your inputs.conf (on the forwarder) setting you need this:

[monitor://path/to/file]
INDEXED_EXTRACTIONS = json

then in props use
[cisco:amp:json]
TIMESTAMP_FIELDS = timestamp

0 Karma

Explorer

Did you check _internal logs for timestamp extraction related errors or warnings?

0 Karma

Legend

@mkarimi17, the JSON in the sample, is that not how the data is sent? i.e. date: 2018-03-08T11:42:57+00:00 does not exist in your _raw data.

If your Timezone is set to PST using Logged in User > Account Settings in Splunk, then you should see event time as PST although the logged time in raw data is UTC.

What time do you see when you try to display the following:

<YourBaseSearch>
| table _time date_hour _raw
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

SplunkTrust
SplunkTrust

Are you looking for the timezone setting in the props.conf file ? As in TZ = UTC or similar?

0 Karma

Legend

@garethatiag, I have converted to comment since it seemed more like a question than answer.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Path Finder

I tried that as well, sorry forgot to include it. But yeah that doesn't work either.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!