Splunk Search

TIME_FORMAT in Epoch

Contributor

Hi,
My log event is in xml and the timestamp is in epoch format e.g. <timestamp>1399909145002</timestamp>

How can I define this in props.conf so the event timestamp will be correctly indexed in splunk?

Thanks in advance!

0 Karma
1 Solution

Splunk Employee
Splunk Employee
TIME_PREFIX = \<timestamp\>

View solution in original post

SplunkTrust
SplunkTrust

Well, you have a slight complication there. What you have there isn't truly epoch (number of seconds since 1/1/1970 00:00:00 GMT). What you have is the number of milliseconds.

But it appears this will work --

[test2] 
TIME_PREFIX=<timestamp> 
TIME_FORMAT=%s%3N 

Splunk Employee
Splunk Employee

Good point!

0 Karma

Splunk Employee
Splunk Employee
TIME_PREFIX = \<timestamp\>

View solution in original post

Splunk Employee
Splunk Employee

Excellent! Thanks for the upvote!

0 Karma

Contributor

The magic works. Thank you.

0 Karma

Splunk Employee
Splunk Employee

If you showed me an entire XML event then I could help you with your event line breaking too.

0 Karma