Splunk Search

define timestamp for json

kirrusk
Path Finder

Hi,

I have a simple json like below ,

 

{"env":"p1","label":"1788_kapi_fed","App":"admin-ipo-sel","lastUpdate":"2020-10-18 19:03:16.956","region":"ea"}{"env":"p1","label":"1788_kapi_fed","App":"admin-ipo-sel","lastUpdate":"2020-10-19 18:29:43.136","region":"ea"}{"env":"p2","label":"1788_kapi_fed","App":"admin-ipo-sel","lastUpdate":"2020-10-19  19:29:45.136","region":"ea"}

timestamp field   -  "lastUpdate":"2020-10-19  19:29:43.136"

trying to define timestamp in props file with below stanza but not working

 

INDEXED_EXTRACTIONS = json

KV_MODE = none

AUTO_KV_JSON = false

TIME_PREFIX = lastUpdate\":\"    tried with this as well (TIME_PREFIX = "lastUpdate":")

TIME_FORMAT = %Y-%m-%d  %H:%M:%S.%N

MAX_TIMESTAMP_LOOKHEAD = 23

No events are coming to splunk with above data.

only below one is working to push data to splunk , Can any please suggest whats going wrong here

 

INDEXED_EXTRACTIONS = json

KV_MODE = none

AUTO_KV_JSON = false

TZ = Asia/Singapore

 

 

Tags (1)
0 Karma

to4kawa
SplunkTrust
SplunkTrust

sample:

| makeresults
| eval _raw="{\"env\":\"p1\",\"label\":\"1788_kapi_fed\",\"App\":\"admin-ipo-sel\",\"lastUpdate\":\"2020-10-18 19:03:16.956\",\"region\":\"ea\"}"
| rex "lastUpdate\":\"(?<time>\S+ \S+?)\""
| eval _time=strptime(time,"%F %T.%3N")

TIME_PREFIX = lastUpdate\":\"
TIME_FORMAT = %Y-%m-%d  %H:%M:%S.%3N

0 Karma

to4kawa
SplunkTrust
SplunkTrust

Is one event one line?

0 Karma

kirrusk
Path Finder

@to4kawa  yes

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.