Getting Data In

[HEC] timestamp recognition

sylim_splunk
Splunk Employee
Splunk Employee

We have data ingesting into Splunk via HEC token, and observed the time parsing of the event is not taking properly.
Example - In the event the timestamp looks like 2020-12-01 09:59:18.0674, but in the Splunk it was capturing 12/1/20 9:59:18.000 AM. Here missing the millisecond in the Splunk time but it's not limited to the millisecond.. sometimes the second field are not correct..

We tried applying the time format and time prefix for the source and sourcetype as below, but it is not fixing the issue.
TIME_PREFIX = "Date": "
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%4N

And also tried the props.conf below;

[the_sourcetype]
AUTO_KV_JSON = false
INDEXED_EXTRACTIONS = json
TIMESTAMP_FIELDS = Date

We use collector/event REST endpoint.

Splunk version 7.2.8.

Labels (1)
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

With 7.2.8 must use collector/raw, not collector/event to recognize timestamp in the payload.

Ver 8.0 with auto_extract_timestamp has been implemented for collector/event
The timestamp recognition issue of this case happened as it's not using collector/raw endpoint.
https://docs.splunk.com/Documentation/Splunk/latest/Data/FormateventsforHTTPEventCollector#Raw_event...

i) Use 'collector/raw' endpoint then it will detect a correct timestamp. 

ii) Upgrade Splunk to 8.0 or above and use auto_extract_timestamp=true with "collector/event".

for example, in 8.0+
$ curl -k http://localhost:8088/services/collector/event?auto_extract_timestamp=true -H "Authorization: Splunk <TOKEN>" -H "content-Type: application/json" -d '{"event": "2020-12-16 00:00:00 Hellow world"}'

View solution in original post

sylim_splunk
Splunk Employee
Splunk Employee

With 7.2.8 must use collector/raw, not collector/event to recognize timestamp in the payload.

Ver 8.0 with auto_extract_timestamp has been implemented for collector/event
The timestamp recognition issue of this case happened as it's not using collector/raw endpoint.
https://docs.splunk.com/Documentation/Splunk/latest/Data/FormateventsforHTTPEventCollector#Raw_event...

i) Use 'collector/raw' endpoint then it will detect a correct timestamp. 

ii) Upgrade Splunk to 8.0 or above and use auto_extract_timestamp=true with "collector/event".

for example, in 8.0+
$ curl -k http://localhost:8088/services/collector/event?auto_extract_timestamp=true -H "Authorization: Splunk <TOKEN>" -H "content-Type: application/json" -d '{"event": "2020-12-16 00:00:00 Hellow world"}'

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>