Splunk Search

why splunk extracts the second timestamp instead of first

net1993
Path Finder

I investigate issue of creating too many new warm buckets and while I do that, one of the events which according to log splunkd has issues has strange problem which I am curious to find out why this happens.

The event:
fdsfds fsdf as dsfsd fdsfds fdsfds fdsfd dsfds dsf.dd

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The body of your question appears unrelated to the topic.
Where are the timestamps in your sample event? What are the props.conf settings for the event's sourcetype?

---
If this reply helps you, Karma would be appreciated.
0 Karma

net1993
Path Finder

Sorry, splunks website filters timestamps for some reason. I tried to paste it many times but its same.
Basicaly: I have 1 event with first 1 unix timestamp and then there is another timestamps with format: Y-m-d h:i:s... and splunk for some reason takes the second timestamp even thought its after the epoch timestamp which is my question why it does that. The sourcetype is default and nothing custom in it.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It sounds like the two timestamps have different formats and Splunk is finding the one that matches what is in datetime.xml. You need to override that using the props.conf settings TIME_PREFIX, TIME_FORMAT, and MAX_TIMESTAMP_LOOKAHEAD. As soon as you post examples of the timestamps we can tell you what the settings should be.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jnudell_2
Builder

Enclose your sample event in either backticks ():
2019-08-02T00:00:00.000 timestamp1 Jan 1, 1970 00:01:02.003 timestamp2`
or code tags:
< pre> ... < /pre>
(remove the space after the opening less than sign)


2019-08-02T00:00:00.000 timestamp1 Jan 1, 1970 00:01:02.003 timestamp2

0 Karma

net1993
Path Finder

For some reason I cannot post the whole event so I place it as comment:
fdsfds fsdf as dsfsd fdsfds fdsfds fdsfd dsfds dsf.dd

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...