Splunk Dev

Timestamp extraction failing for data indexed via summary indexing

sdubey_splunk
Splunk Employee
Splunk Employee

Scenerio:
1.Created summary index and scheduled to run every 5 minutes
2.We can see that summary index is writing data to new index
3.But the time stamp of event was wrong. So we wanted to extract the time stamp from our event.

As per documentation:
Scheduled report with summary indexing by default Splunk assigns the source field to the name of the generating report and sourcetype field to "stash" which is how Splunk know that data is already in Splunk and the summary data will not be charged against the license

In our use case report for summary indexing name was "test_report"

  1. To extract date we configured and updated props.conf on indexer to extract correct time from event. eg: Below props.conf I tested on sample event by manually uploading the data to splunk and I found it working as required.

[source::test_report]
MAX_TIMESTAMP_LOOKAHEAD=19
TIME_PREFIX= CreateDate=\"
TIME_FORMAT = %Y-%m-%d %H:%M:%S

Restarted Splunk splunk on indexer but still time stamp of summary indexed data was showing incorrect

  1. We tried using sourcetype id stash to see if it works.

Updated props.conf on indexer as below

[sourcetype::stash]
MAX_TIMESTAMP_LOOKAHEAD=19
TIME_PREFIX= CreateDate=\"
TIME_FORMAT = %Y-%m-%d %H:%M:%S

Restarted Splunk splunk on indexer but still time stamp of summary indexed data was showing incorrect

Tags (1)
0 Karma

sdubey_splunk
Splunk Employee
Splunk Employee

1.On a Search Head:
Settings > Searches, reports, and alerts -> Open test_report : alert
append your search with below (add to the end of your search string)

| eval _time=strptime(CreateDate,"%Y-%m-%d %H:%M:%S")

  1. Wait for next schedule to run and it started working ie timestamp extraction worked.

For summary indexing report if you ever had to extract time please add _time as part of your search. Updating props.conf on indexer will not work as per my experience.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...