Getting Data In

timestamp=none

gcusello
Esteemed Legend

I acquired some logs from a scrip (close to ps.sh) with a timestamp correctly recognized at index time.
The problem is that the "timestamp" field is always equal to "none" so I cannot have the other date fields (date_wday, date_hour, etc...).
I tried to configure the TIMESTAMP_FORMAT but I always acquire events with "timestamp=none".
Anyone has any idea?
thank you in advance.
Bye.
Giuseppe

0 Karma
1 Solution

woodcock
Esteemed Legend

When you use a scripted input the default is to use now as the timestamp so the usual timestamp normalization is not necessary, not done, and all the date* fileds are not created (which are ALWAYS WRONG anyway so they should NEVER be used; you should always create your own with eval date_whatever = strftime(_time, "whatever")). Additionally, in such a circumstance, a timestamp field set to value none is created. There is no need to configure anything; this is all normal. Your events (timestamps) are fine.

Also, see this Q&A about those fields (and how and why to create your own):
https://answers.splunk.com/answers/243017/counting-the-total-number-of-days-for-all-time.html

View solution in original post

woodcock
Esteemed Legend

When you use a scripted input the default is to use now as the timestamp so the usual timestamp normalization is not necessary, not done, and all the date* fileds are not created (which are ALWAYS WRONG anyway so they should NEVER be used; you should always create your own with eval date_whatever = strftime(_time, "whatever")). Additionally, in such a circumstance, a timestamp field set to value none is created. There is no need to configure anything; this is all normal. Your events (timestamps) are fine.

Also, see this Q&A about those fields (and how and why to create your own):
https://answers.splunk.com/answers/243017/counting-the-total-number-of-days-for-all-time.html

gcusello
Esteemed Legend

Ok I extracted weekday and hours from _time using eval.
thank you.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...