How to import std::chrono::system_clock::now().time_since_epoch().count() as timestamp

[panharry]

Hello 🙂
I have an application that uses std::chrono::system_clock::now().time_since_epoch().count() as timestamp. The output is a 17 digit number like 15613916758394847. The number corresponds with the date GMT: Monday, 24. June 2019 15:54:35.839.

How can I import that timestamp into Splunk in human readable form?

[panharry]

Thanks a lot MuS 🙂
I played around already in that area.
And timestamp recognition says "%s Epoch (10 digits)" and "%9N = nanoseconds". That makes 19 digits for me and I have only 17.
But it works as you said 😄

[MuS · Accepted solution]

Hi panharry,

First of all, please don't change datetime.xml.

There are two options for you to get this timestamp either by using props.conf to set the timestamp at parsing time or by using rex to get it by search time.

To do it at index/paring time you need to configure a props.conf for the sourcetype and options like this:

[yourSourceTypeNameHereToMatch]
TIME_FORMAT = %s%9N

This will try to match your 17 digits as timestamp in _raw, you might need to add a TIME_PREFIX and/or increase the MAX_TIMESTAMP_LOOKAHEAD options as well to get to the timestamp in the event. Please read the docs about props.conf on this.

For the search time example, please refer to this example:

| makeresults 
| eval myTime="15613916758394847", myNewTime=strptime(myTime, "%s%9N"), myNewTime2=strftime(myNewTime, "%Y-%m-%d %H:%M:%S.%9N")

the first line just creates a dummy event, the next line creates the sample timestamp and parses it into myNewTime as epoch. myNewTime2 is the human readable version of myNewTime.

Hope this helps ...

cheers, MuS

[panharry]

I read a lot of stuff in the Splunk documentation.
As far as I understood it the file "/etc/datetime.xml" is responsible to for recognition of a timestamp.
This file contains the following stanza:

    <!-- update regex before '2017' -->
<text><![CDATA[((?<=^|[\s#,"=\(\[\|\{])(?:1[012345]|9)\d{8}|^@[\da-fA-F]{16,24})(?:\.?(\d{1,6}))?(?![\d\(])]]></text>

I'm no regexp specialist but it looks like it should be positive with the above mentioned number.
Then why does the import not work like expected?