Getting Data In

How to edit my TIME_PREFIX in props.conf to properly extract the timestamp from my sample event?

joshualarkins
Explorer
-health_checkin_date: 2016-10-30T09:45:28.824Z

That is the line from a JSON event being sent into my Splunk instance via TCP syslog. It's being put into an index in an app I made, so I added the following the props.conf of that app:

[company_product]
TRUNCATE=0
TIME_PREFIX=\"-health_checkin_date\":\s
TIME_FORMAT=%Y-%m-%dT%T.%3N%Z
CHARSET=AUTO
KV_MODE=NONE
INDEXED_EXTRACTIONS=JSON

This stanza matches what is set in the TCP receiver as the custom sourcetype for this port, but the timestamp isn't being properly extracted. I'm intentionally prefixing the field with a hyphen so Splunk will find it quickly in the event. Am I editing the wrong props.conf?

1 Solution

lguinn2
Legend

Yes, I believe that your time prefix is incorrect. A regular expression does not need to be placed in quotation marks. Try this:

TIME_PREFIX=-health_checkin_date:\s

View solution in original post

lguinn2
Legend

Yes, I believe that your time prefix is incorrect. A regular expression does not need to be placed in quotation marks. Try this:

TIME_PREFIX=-health_checkin_date:\s

View solution in original post

joshualarkins
Explorer
[company_product]
TRUNCATE=0
TIME_PREFIX=\"-health_checkin_date\":\"
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N
TZ=UTC
CHARSET=AUTO
KV_MODE=JSON
INDEXED_EXTRACTIONS=JSON

ended up solving it right after I posted this. I think it might be extra important to view the raw log and build the time prefix based on this, rather than attempt to guess based on the way Splunk shows JSON data all prettified.

0 Karma

joshualarkins
Explorer

... Is my TIME_PREFIX incorrect?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.