Getting Data In

json in splunk is ignoring the timestamp

anthonycopus
Path Finder

Hi I currently have the following json in splunk:

{"first_name": "john", "last_name": "black", "timestamp": "2013-09-09 08:00:00", "age": "26", "activity": "start"}

The issue is that splunk should read the timestamp and use that for the time the event is logged. However, it simply is taking the time the event was indexed into the system instead. There is no problem with the other fields, they are parsed fine by splunk.

How should I make splunk recognise the timestamp in this json? Is it possible for it to be done automatically if the format the timestamp is written in it changed?

Anthony

amanteja
Path Finder
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...