Getting Data In
Highlighted

What is the proper TIME_FORMAT I should use in props.conf for my sample data?

Communicator

I am trying to create props.conf for a log file which has entries like below,

{"timestamp":1429805010594,"message":"Deployment with pending data read by user 'tempaccount'","eventId":1041,"metadata":{}}
{"timestamp":1429805597016,"message":"Deployment Archive for Service with ID 'instance-2' read by 'tempaccount","eventId":1040,"metadata":{}}

I am not able to figure out the timeformat use there, i tried using TIME_FORMAT = %s but that is not working. My customer told me that the data is in json format if that helps anyway.

Any ideas?

Tags (2)
0 Karma
Highlighted

Re: What is the proper TIME_FORMAT I should use in props.conf for my sample data?

Splunk Employee
Splunk Employee
TIME_FORMAT = %s%3N
TIME_PREFIX = {"timestamp":
#MAX_TIMESTAMP_LOOKAHEAD = 0

You have 13 digit epoch time, you must account for the higher precision.
As per doc %s represents a 10 digit epoch timestamp.
TIMEPREFIX is also required because the timestamp is not 10 digits...so this will confirm for Splunk that it's got the right one.
MAX
TIMESTAMP_LOOKAHEAD overrides the default of 127 but it worked for me without it... depends on the rest of the events and you've only provided two.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

Highlighted

Re: What is the proper TIME_FORMAT I should use in props.conf for my sample data?

Communicator

Thats simply awesome...... Thanks a ton.

0 Karma
Highlighted

Re: What is the proper TIME_FORMAT I should use in props.conf for my sample data?

Splunk Employee
Splunk Employee

my pleasure. Sometimes it's just another pair of eyeballs. 🙂

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma