Getting Data In

[HEC] timestamp recognition

sylim_splunk
Splunk Employee
Splunk Employee

We have data ingesting into Splunk via HEC token, and observed the time parsing of the event is not taking properly.
Example - In the event the timestamp looks like 2020-12-01 09:59:18.0674, but in the Splunk it was capturing 12/1/20 9:59:18.000 AM. Here missing the millisecond in the Splunk time but it's not limited to the millisecond.. sometimes the second field are not correct..

We tried applying the time format and time prefix for the source and sourcetype as below, but it is not fixing the issue.
TIME_PREFIX = "Date": "
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%4N

And also tried the props.conf below;

[the_sourcetype]
AUTO_KV_JSON = false
INDEXED_EXTRACTIONS = json
TIMESTAMP_FIELDS = Date

We use collector/event REST endpoint.

Splunk version 7.2.8.

Labels (1)
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

With 7.2.8 must use collector/raw, not collector/event to recognize timestamp in the payload.

Ver 8.0 with auto_extract_timestamp has been implemented for collector/event
The timestamp recognition issue of this case happened as it's not using collector/raw endpoint.
https://docs.splunk.com/Documentation/Splunk/latest/Data/FormateventsforHTTPEventCollector#Raw_event...

i) Use 'collector/raw' endpoint then it will detect a correct timestamp. 

ii) Upgrade Splunk to 8.0 or above and use auto_extract_timestamp=true with "collector/event".

for example, in 8.0+
$ curl -k http://localhost:8088/services/collector/event?auto_extract_timestamp=true -H "Authorization: Splunk <TOKEN>" -H "content-Type: application/json" -d '{"event": "2020-12-16 00:00:00 Hellow world"}'

View solution in original post

sylim_splunk
Splunk Employee
Splunk Employee

With 7.2.8 must use collector/raw, not collector/event to recognize timestamp in the payload.

Ver 8.0 with auto_extract_timestamp has been implemented for collector/event
The timestamp recognition issue of this case happened as it's not using collector/raw endpoint.
https://docs.splunk.com/Documentation/Splunk/latest/Data/FormateventsforHTTPEventCollector#Raw_event...

i) Use 'collector/raw' endpoint then it will detect a correct timestamp. 

ii) Upgrade Splunk to 8.0 or above and use auto_extract_timestamp=true with "collector/event".

for example, in 8.0+
$ curl -k http://localhost:8088/services/collector/event?auto_extract_timestamp=true -H "Authorization: Splunk <TOKEN>" -H "content-Type: application/json" -d '{"event": "2020-12-16 00:00:00 Hellow world"}'

Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...