Getting Data In

how to set TIME_PREFIX for a json file?

anooshac
Path Finder

I have a JSON file like this.
{
"ACC_NAME": "A",
"DEPT": [{
"NAME": "D1",
"PROJECT": [{
"P_NAME": "xyz",
"START_DATE": "1/5/2020 5:01:00",
"END_DATE": "1/31/2020 7:21:32",
"STATUS": "PASS"
}]
}]
}
I have been trying to set TIME_PREFIX and it's not working. As you can see there are two dates.When I set TIME_PREFIX= START_DATE i got time stamp error. How can i set TIME_PREFIX so that both the dates are included?

Tags (2)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

Since you are trying to set timestamp for the events, you can try below configuration.

[_json]
INDEXED_EXTRACTIONS = json
KV_MODE = none
AUTO_KV_JSON = false
TIMESTAMP_FIELDS = DEPT.PROJECT.START_DATE

View solution in original post

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Since you are trying to set timestamp for the events, you can try below configuration.

[_json]
INDEXED_EXTRACTIONS = json
KV_MODE = none
AUTO_KV_JSON = false
TIMESTAMP_FIELDS = DEPT.PROJECT.START_DATE

View solution in original post

0 Karma

anooshac
Path Finder

hi @manjunathmeti , thank you so much!!! It is working, and i am getting all the fields of the json file.

0 Karma

493669
Super Champion

Hi @anooshac, try below by escaping special characters-

TIME_PREFIX= \"START_DATE\": \"
0 Karma

493669
Super Champion

Also provide Time_format as per your time format is like below-

TIME_FORMAT=%d/%m/%Y %H:%M:%S
0 Karma

anooshac
Path Finder

hi i tried that and i'm still getting as "Failed to parse timestamp". How can i include the END_DATE aslo?

0 Karma

493669
Super Champion

Timestamp is assigned with only one field either START_DATE or END_DATE .
Can you share your props.conf ? (in code block)

0 Karma

anooshac
Path Finder

[_json]
DATETIME_CONFIG =
LINE_BREAKER = ([\r\n]+)
disabled = false
TIME_FORMAT = %m/%d/%Y %H:%M:%S %z
TIME_PREFIX = \"START_DATE\": \"
MAX_TIMESTAMP_LOOKAHEAD = 128
BREAK_ONLY_BEFORE_DATE =

This is props.conf file.

0 Karma

to4kawa
Ultra Champion
LINE_BREAKER = ([\r\n]+)

your JSON is one line?

0 Karma

anooshac
Path Finder

hi @to4kawa , no my json is not a one line file.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!