Configure Timestamp field

[klausJohan]

Hello all,

Suppose I index JSON objects into Splunk and that each of these objectst has a timestamp key. What input should there be in the props.conf file in order for Splunk to automatically configure the default timestamp field to the previous mentioned JSON key ?

Thanks

[gfuente · Accepted solution]

Hello

then you need to use:

TIME_PREFIX=stats_time\s:\s
TIME_FORMAT=%s

Try it and let me know if it worked

[gfuente]

What field?

Try _time field instead

Or look at the timestamp located at the left side of the event in the flashtimeline view

[klausJohan]

Unfortunately I still see that the timestamp field gets filled with 'none' only .

[klausJohan]

Indexed events look like this:

{
name : "PA",
id : "5",
........
stats_time : 1386940477673,
........
type : "Port"
}

"stats_time" is the key that I'm interested in to be rolled into the timestamp default field.

[gfuente]

Please include a sample event