Getting Data In

How to Timestamp Events

skoelpin
SplunkTrust
SplunkTrust

I have an index which is not timestamping the events. I looked in the Docs and it said I have to define it in my props.conf

If this is true, can someone help me with the correct stanza?

Here's what a few of my non-timestamped events look like

1451406708913 172.xx.xx.xx - 160195 98610 3.12 1.19 200 21105 0 8 /graph?node=10904&profiles=roomsOnly

1451406708879 172.xx.xx.xx - 160194 13073 4.50 3.69 200 6 0 8 /graph?node=10930
Tags (2)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

The stanza you need to change in props.conf will be named after the sourcetype of the data.

I'm making comment on renjith.nair's response because if you read the documentation you'll understand this. However i'm also giving you the answer here:

[sourcetypeName]
TIME_PREFIX = ^
TIME_FORMAT = %s%3n

Finally, I must also note this looks like web traffic logs which splunk already has many sourcetypes preconfigured for. You might benefit more by using the IIS logs or Apache logs sourcetypes.

skoelpin
SplunkTrust
SplunkTrust

I read those docs before posting here.. It looks like the timestamp is being assigned to some hosts in that index and not assigning a timestamp to other hosts

How do I get a timestamp on ALL hosts?

0 Karma

jkat54
SplunkTrust
SplunkTrust

Please explain what is meant by ALL hosts?

Do you have some hosts which are sending this data in without the correct timestamps? If so check that props.conf is on every indexer and forwarder that is sending the data in, even the universal forwarders.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...