Getting Data In

Use JSON epoch date time instead of index time

mkarimi17
Path Finder

I have a JSON that is for emails like the following:

{   [-] 
     computer:  {   [+] 
    }   
     date:   2018-03-08T11:42:57+00:00      
     event_type_id:  553648152  
     timestamp:  1520509377 
     timestamp_nanoseconds:  893334279  
}

Note: the time above is in UTC.

However, my time is set to PST and so it looks like I'm getting the index time, timestamp of "11/14/17 6:50:49.000 PM"

This is what's in my props.conf:

[cisco:amp:json]
SHOULD_LINEMERGE = true
pulldown_type = 1
category = Splunk App Add-on Builder
LINE_BREAKER = ([\r\n]*)\{\"event_type\"\:
TIME_PREFIX = timestamp:\s*
TIME_FORMAT = %s
KV_MODE = json
TRANSFORMS-amp_hostname = force_amp_hostname
EXTRACT-amp_hostname = \"hostname\"\:\s*\"(?<dest>[^\"]*)
EXTRACT-amp_file_name = \"file_name\"\:\s*\"(?<file_name>[^\"]*)
EXTRACT-amp_file_path = \"file_path\"\:\s*\"(?<file_path>[^\"]*)
EXTRACT-amp_user = \"user\"\:\s?\"(?<user>[^\"]+)
EVAL-signature =
EVAL-action =
EVAL-file_hash =
BREAK_ONLY_BEFORE = ([\r\n]*)\{\"event_type\"\:
DATETIME_CONFIG =
NO_BINARY_CHECK = true
disabled = false
INDEXED_EXTRACTIONS = json
0 Karma

jplumsdaine22
Influencer

in your inputs.conf (on the forwarder) setting you need this:

[monitor://path/to/file]
INDEXED_EXTRACTIONS = json

then in props use
[cisco:amp:json]
TIMESTAMP_FIELDS = timestamp

0 Karma

danbar6
Explorer

Did you check _internal logs for timestamp extraction related errors or warnings?

0 Karma

niketn
Legend

@mkarimi17, the JSON in the sample, is that not how the data is sent? i.e. date: 2018-03-08T11:42:57+00:00 does not exist in your _raw data.

If your Timezone is set to PST using Logged in User > Account Settings in Splunk, then you should see event time as PST although the logged time in raw data is UTC.

What time do you see when you try to display the following:

<YourBaseSearch>
| table _time date_hour _raw
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

gjanders
SplunkTrust
SplunkTrust

Are you looking for the timezone setting in the props.conf file ? As in TZ = UTC or similar?

0 Karma

niketn
Legend

@garethatiag, I have converted to comment since it seemed more like a question than answer.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

mkarimi17
Path Finder

I tried that as well, sorry forgot to include it. But yeah that doesn't work either.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...