define timestamp for json

[kirrusk]

Hi,

I have a simple json like below ,

{"env":"p1","label":"1788_kapi_fed","App":"admin-ipo-sel","lastUpdate":"2020-10-18 19:03:16.956","region":"ea"}{"env":"p1","label":"1788_kapi_fed","App":"admin-ipo-sel","lastUpdate":"2020-10-19 18:29:43.136","region":"ea"}{"env":"p2","label":"1788_kapi_fed","App":"admin-ipo-sel","lastUpdate":"2020-10-19  19:29:45.136","region":"ea"}

timestamp field   -  "lastUpdate":"2020-10-19  19:29:43.136"

trying to define timestamp in props file with below stanza but not working

INDEXED_EXTRACTIONS = json

KV_MODE = none

AUTO_KV_JSON = false

TIME_PREFIX = lastUpdate\":\"    tried with this as well (TIME_PREFIX = "lastUpdate":")

TIME_FORMAT = %Y-%m-%d  %H:%M:%S.%N

MAX_TIMESTAMP_LOOKHEAD = 23

No events are coming to splunk with above data.

only below one is working to push data to splunk , Can any please suggest whats going wrong here

INDEXED_EXTRACTIONS = json

KV_MODE = none

AUTO_KV_JSON = false

TZ = Asia/Singapore

[to4kawa]

sample:

| makeresults
| eval _raw="{\"env\":\"p1\",\"label\":\"1788_kapi_fed\",\"App\":\"admin-ipo-sel\",\"lastUpdate\":\"2020-10-18 19:03:16.956\",\"region\":\"ea\"}"
| rex "lastUpdate\":\"(?<time>\S+ \S+?)\""
| eval _time=strptime(time,"%F %T.%3N")

TIME_PREFIX = lastUpdate\":\"
TIME_FORMAT = %Y-%m-%d  %H:%M:%S.%3N

[to4kawa]

Is one event one line?

[kirrusk]

@to4kawa  yes