Getting Data In

timestamp extraction from json

Ekino
Engager

Hi Splunk Gurus

 

Could you someone help me to resolve my Issue with timestamp extraction?

The Issue is that when I want to create a sourcetype with custom timestamp via advanced configuration

where I defined TIME_PREFIX as regular expression ^(?:[^\}\n]*\}){4},\{"\w+":"(?P<timestamp_ex>[^"]+) then timesstamp extraction is not working and I getting  error "failed to parse timestamp. Defaulting to file modtime."

regular expresion I got from splunk field extraction. Why Splunk doesn't accept my regex which was generated by Slunk itself? and tested out via regex101.com where the expression is working.

extract_fields.pngset_source_type.png

Labels (4)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The TIME_PREFIX setting does not tell Splunk how to extract the timestamp field.  It merely tells Splunk where to *find* the timestamp.  The regex should describe the text that comes right before the timestamp.  There's no need for capture groups. 

As is normally the case with the Splunk field extractor, the regex it generates is overly verbose.  It's rarely necessary to describe everything from the beginning of the event until the timestamp - all you need is just enough to find the timestamp.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

Ekino
Engager

Thanks for your answer, it was helpfull

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The TIME_PREFIX setting does not tell Splunk how to extract the timestamp field.  It merely tells Splunk where to *find* the timestamp.  The regex should describe the text that comes right before the timestamp.  There's no need for capture groups. 

As is normally the case with the Splunk field extractor, the regex it generates is overly verbose.  It's rarely necessary to describe everything from the beginning of the event until the timestamp - all you need is just enough to find the timestamp.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...