Getting Data In

json in splunk is ignoring the timestamp

anthonycopus
Path Finder

Hi I currently have the following json in splunk:

{"first_name": "john", "last_name": "black", "timestamp": "2013-09-09 08:00:00", "age": "26", "activity": "start"}

The issue is that splunk should read the timestamp and use that for the time the event is logged. However, it simply is taking the time the event was indexed into the system instead. There is no problem with the other fields, they are parsed fine by splunk.

How should I make splunk recognise the timestamp in this json? Is it possible for it to be done automatically if the format the timestamp is written in it changed?

Anthony

amanteja
Path Finder
0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...