Hi,
I have a simple json like below ,
{"env":"p1","label":"1788_kapi_fed","App":"admin-ipo-sel","lastUpdate":"2020-10-18 19:03:16.956","region":"ea"}{"env":"p1","label":"1788_kapi_fed","App":"admin-ipo-sel","lastUpdate":"2020-10-19 18:29:43.136","region":"ea"}{"env":"p2","label":"1788_kapi_fed","App":"admin-ipo-sel","lastUpdate":"2020-10-19 19:29:45.136","region":"ea"}
timestamp field - "lastUpdate":"2020-10-19 19:29:43.136"
trying to define timestamp in props file with below stanza but not working
INDEXED_EXTRACTIONS = json
KV_MODE = none
AUTO_KV_JSON = false
TIME_PREFIX = lastUpdate\":\" tried with this as well (TIME_PREFIX = "lastUpdate":")
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%N
MAX_TIMESTAMP_LOOKHEAD = 23
No events are coming to splunk with above data.
only below one is working to push data to splunk , Can any please suggest whats going wrong here
INDEXED_EXTRACTIONS = json
KV_MODE = none
AUTO_KV_JSON = false
TZ = Asia/Singapore
sample:
| makeresults
| eval _raw="{\"env\":\"p1\",\"label\":\"1788_kapi_fed\",\"App\":\"admin-ipo-sel\",\"lastUpdate\":\"2020-10-18 19:03:16.956\",\"region\":\"ea\"}"
| rex "lastUpdate\":\"(?<time>\S+ \S+?)\""
| eval _time=strptime(time,"%F %T.%3N")
TIME_PREFIX = lastUpdate\":\"
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N
Is one event one line?
@to4kawa yes