Getting Data In

timestamp=none

gcusello
SplunkTrust
SplunkTrust

I acquired some logs from a scrip (close to ps.sh) with a timestamp correctly recognized at index time.
The problem is that the "timestamp" field is always equal to "none" so I cannot have the other date fields (date_wday, date_hour, etc...).
I tried to configure the TIMESTAMP_FORMAT but I always acquire events with "timestamp=none".
Anyone has any idea?
thank you in advance.
Bye.
Giuseppe

0 Karma
1 Solution

woodcock
Esteemed Legend

When you use a scripted input the default is to use now as the timestamp so the usual timestamp normalization is not necessary, not done, and all the date* fileds are not created (which are ALWAYS WRONG anyway so they should NEVER be used; you should always create your own with eval date_whatever = strftime(_time, "whatever")). Additionally, in such a circumstance, a timestamp field set to value none is created. There is no need to configure anything; this is all normal. Your events (timestamps) are fine.

Also, see this Q&A about those fields (and how and why to create your own):
https://answers.splunk.com/answers/243017/counting-the-total-number-of-days-for-all-time.html

View solution in original post

woodcock
Esteemed Legend

When you use a scripted input the default is to use now as the timestamp so the usual timestamp normalization is not necessary, not done, and all the date* fileds are not created (which are ALWAYS WRONG anyway so they should NEVER be used; you should always create your own with eval date_whatever = strftime(_time, "whatever")). Additionally, in such a circumstance, a timestamp field set to value none is created. There is no need to configure anything; this is all normal. Your events (timestamps) are fine.

Also, see this Q&A about those fields (and how and why to create your own):
https://answers.splunk.com/answers/243017/counting-the-total-number-of-days-for-all-time.html

gcusello
SplunkTrust
SplunkTrust

Ok I extracted weekday and hours from _time using eval.
thank you.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...