Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How do I extract the time from Operating System ev...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am trying to extract the time from event from the AV system. The output is set up to be sent to Splunk over UDP every 15 minutes. Splunk is setting _time as the download time, not the time of the event.
This is the format of the message -
Apr 12 07:04:00 10.00.00.00 Apr 12 2018 07:04:00 system.corp.net CEF:0|AV System|Manager System|2.2|444444|Device Access Control|3|rt=Apr 12 2018 11:53:17 GMT+00:00 cs1Label=Product_Entity/Endpoint
I have tried the following
TIMESTAMP_FIELDS = rt
TZ = America/Chicago
TIME_FORMAT = %b %d %Y %H:%M:%S %Z%z
TIME_PREFIX = rt=
MAX_TIMESTAMP_LOOKAHEAD = 160
What am I missing?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi scottrunyon,
modify TIME_PREFIX because = is a special char for regex
TIME_PREFIX = rt\=
and
MAX_TIMESTAMP_LOOKAHEAD = 31
and I shouldn't use
TIMESTAMP_FIELDS = rt
Bye.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi scottrunyon,
modify TIME_PREFIX because = is a special char for regex
TIME_PREFIX = rt\=
and
MAX_TIMESTAMP_LOOKAHEAD = 31
and I shouldn't use
TIMESTAMP_FIELDS = rt
Bye.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That did not work. The events are showing Time as the download time.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi scottrunyon,
do you receive these logs on Indexer or on Heavy Forwarder?
where is this props.conf?
It must be on the same server that receive logs.
Bye.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It is received on the indexer. I have a single instance and props.conf is under \search\local.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
if you have timezone GMT+00:00, you have to use %:z, try:
TIME_FORMAT = %b %d %Y %H:%M:%S %Z%:z
Bye.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That didn't work It looks like it is pulling the time from the first part of the event.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am doing these changes through the "Source Type" web interface, which updates props.conf when saved. Do I have to a restart of Splunk to get the changes to take?
I am running on a Windows server.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I did a restart this morning and the time is what I need it to be.
Thanks for the help.
Scott
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you try increasing value for MAX_TIMESTAMP_LOOKAHEAD ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, it was 128 to start.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you try :
TZ = America/Chicago
TIME_FORMAT = %b %d %Y %H:%M:%S %Z%:z
TIME_PREFIX = \|rt\=
MAX_TIMESTAMP_LOOKAHEAD = 160
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
