Splunk Search

How to configure timestamp recognition for JSON data inputs?

Path Finder


Until now, I had comma separated text inputs from many of my sources. Using props.conf, I could define the timestamp (e.g. which position and look ahead etc).

However, I anticipate JSON data inputs very shortly. I'm not sure what would be the steps/process to be able to specify timestamp (i.e. which time component to use for associating with searches)

Any pointers would be greatly appreciated

thanks, ronak

0 Karma

Splunk Employee
Splunk Employee

@ronak you can use INDEXED_EXTRACTIONS = JSON for accomplishing this

* Tells Splunk the type of file and the extraction and/or parsing method Splunk should use
on the file.
CSV - Comma separated value format
TSV - Tab-separated value format
PSV - pipe "|" separated value format
W3C - W3C Extended Extended Log File Format
JSON - JavaScript Object Notation format
* These settings default the values of the remaining settings to the
appropriate values for these known formats.
* Defaults to unset.

in props.conf on the UF set in $SPLUNK_HOME/etc/system/local/props.conf:

KV_MODE = none

restart splunk
./splunk restart



Shouldn't be any different. Regex is still regex.

Unless your new inputs are multiple lines per event. Then you might have to do some work to combine them into a single event, but even then, you should still be able to regex your timestamp out.

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...