Splunk Search
Highlighted

How do you convert time in EPOCH Scientific Notation for Props.conf TIME_FORMAT on a universal forwarder?

Explorer

We have a sevone network monitoring a JSON data time field formatted as EPOCH in Scientific Notation format. All the examples do not show how to take into account for Scientific Notation. Any assistance would be appreciated. time=1.539895001846788E9

We currently have this setup for DATETIME_CONFIG=CURRENT but then all the events are off and it looks like they are being batch loaded every 4 hours in the search time line.

raw data in filesystem log file. Using inputs.conf with props.conf on the UF on the syslog servers:

{"deviceId":2911,"deviceName":"SS-L1-AGNEW-2","deviceIp":"10.10.14.68","peerId":5,"objectId":227468,"objectName":"Ethernet1/30","objectDesc":"Ethernet1/30","pluginId":1,"pluginName":"SNMP Poller","indicatorId":1420925,"indicatorName":"s1_TotalErrors","format":0,"value":"0.0","**time**":**_1.539895001846788E9_**,"clusterName":"NMS","peerIp":"10.10.30.46"}

I have in props.conf TIMEPREFIX=\"time\": , but I have not found any entry for TIMEFORMAT that works.

If this will not work for PROPS, any suggestions on how to get the correct time for indexing would be appreciated.

TY

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.