Splunk Search

How to achieve providing timestamp field when event does not contain time in it?

poojithavasanth
Explorer

Hello,

I wanted a EVAL statement which manually adds a specified time may be "00:00:00" for the event containing only date component in them.

Example of the file: (psv format)

Poojitha Vasanth|21644|669194|Poojitha Vasanth|02/19/18|PRE-CLINIC VISIT|

Current sourcetype:

[sample:xx:audit:psv]

EVAL-event_dt_tm = date
FIELD_NAMES = "prsnl_name","prsnl_alias","person_alias","person_name","date","event_name"
TIMESTAMP_FIELDS = "date"

And, I have modified it to.

EVAL-time = "00:00:00"
EVAL-event_dt_tm = date.time
FIELD_NAMES = "prsnl_name","prsnl_alias","person_alias","person_name","date","event_name"
TIMESTAMP_FIELDS = "date","time"

 

Even after this change, I am getting the ingested date and time and the actual log time.

Could anyone please let me know where I have gone wrong?

Labels (1)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The TIMESTAMP_FIELDS setting applies only when INDEXED_EXTRACTIONS is used.  If you use TIME_FORMAT = %d/%m/%y (assuming day,month,year format) then Splunk will set the time to 00:00:00.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

poojithavasanth
Explorer

Thanks @richgalloway . Appreciate your help!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The TIMESTAMP_FIELDS setting applies only when INDEXED_EXTRACTIONS is used.  If you use TIME_FORMAT = %d/%m/%y (assuming day,month,year format) then Splunk will set the time to 00:00:00.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...