Splunk Search

why splunk extracts the second timestamp instead of first

net1993
Path Finder

I investigate issue of creating too many new warm buckets and while I do that, one of the events which according to log splunkd has issues has strange problem which I am curious to find out why this happens.

The event:
fdsfds fsdf as dsfsd fdsfds fdsfds fdsfd dsfds dsf.dd

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The body of your question appears unrelated to the topic.
Where are the timestamps in your sample event? What are the props.conf settings for the event's sourcetype?

---
If this reply helps you, Karma would be appreciated.
0 Karma

net1993
Path Finder

Sorry, splunks website filters timestamps for some reason. I tried to paste it many times but its same.
Basicaly: I have 1 event with first 1 unix timestamp and then there is another timestamps with format: Y-m-d h:i:s... and splunk for some reason takes the second timestamp even thought its after the epoch timestamp which is my question why it does that. The sourcetype is default and nothing custom in it.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It sounds like the two timestamps have different formats and Splunk is finding the one that matches what is in datetime.xml. You need to override that using the props.conf settings TIME_PREFIX, TIME_FORMAT, and MAX_TIMESTAMP_LOOKAHEAD. As soon as you post examples of the timestamps we can tell you what the settings should be.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jnudell_2
Builder

Enclose your sample event in either backticks ():
2019-08-02T00:00:00.000 timestamp1 Jan 1, 1970 00:01:02.003 timestamp2`
or code tags:
< pre> ... < /pre>
(remove the space after the opening less than sign)


2019-08-02T00:00:00.000 timestamp1 Jan 1, 1970 00:01:02.003 timestamp2

0 Karma

net1993
Path Finder

For some reason I cannot post the whole event so I place it as comment:
fdsfds fsdf as dsfsd fdsfds fdsfds fdsfd dsfds dsf.dd

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...