Getting Data In

What is the proper TIME_FORMAT I should use in props.conf for my sample data?

anoopambli
Communicator

I am trying to create props.conf for a log file which has entries like below,

{"timestamp":1429805010594,"message":"Deployment with pending data read by user 'tempaccount'","eventId":1041,"metadata":{}}
{"timestamp":1429805597016,"message":"Deployment Archive for Service with ID 'instance-2' read by 'tempaccount","eventId":1040,"metadata":{}}

I am not able to figure out the timeformat use there, i tried using TIME_FORMAT = %s but that is not working. My customer told me that the data is in json format if that helps anyway.

Any ideas?

Tags (2)
0 Karma
1 Solution

rsennett_splunk
Splunk Employee
Splunk Employee
TIME_FORMAT = %s%3N
TIME_PREFIX = {"timestamp":
#MAX_TIMESTAMP_LOOKAHEAD = 0

You have 13 digit epoch time, you must account for the higher precision.
As per doc %s represents a 10 digit epoch timestamp.
TIME_PREFIX is also required because the timestamp is not 10 digits...so this will confirm for Splunk that it's got the right one.
MAX_TIMESTAMP_LOOKAHEAD overrides the default of 127 but it worked for me without it... depends on the rest of the events and you've only provided two.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

rsennett_splunk
Splunk Employee
Splunk Employee
TIME_FORMAT = %s%3N
TIME_PREFIX = {"timestamp":
#MAX_TIMESTAMP_LOOKAHEAD = 0

You have 13 digit epoch time, you must account for the higher precision.
As per doc %s represents a 10 digit epoch timestamp.
TIME_PREFIX is also required because the timestamp is not 10 digits...so this will confirm for Splunk that it's got the right one.
MAX_TIMESTAMP_LOOKAHEAD overrides the default of 127 but it worked for me without it... depends on the rest of the events and you've only provided two.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

anoopambli
Communicator

Thats simply awesome...... Thanks a ton.

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

my pleasure. Sometimes it's just another pair of eyeballs. 🙂

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...