Knowledge Management

Logging Format: Should time be in its own KVP?

daniel333
Builder

Were writing a small app and ensuring all logs are KVP and using CIM terminology. However, I just realized I was leaving time as the start of each line and writing a props.conf for it, which is fine I suppose.

BUT seems to me time should be in its own KVP. Will doing this cause issues at all? Better practice? Here is an example in bash (we're working in Java however)

logger "_time=\"`date`\" myapp=app etc etc "
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Having a KVP around the timestamp would not cause any issues. One suggestion I would make is to have the field name for timestamp something other than _time. It will not cause any issues but _time is reserved field name and it will force Splunk to rename the field as "time" (with string value of the timestamp). Just to avoid this unnecessary name conversion, I would change _time to timestamp OR simply time OR date.

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Having a KVP around the timestamp would not cause any issues. One suggestion I would make is to have the field name for timestamp something other than _time. It will not cause any issues but _time is reserved field name and it will force Splunk to rename the field as "time" (with string value of the timestamp). Just to avoid this unnecessary name conversion, I would change _time to timestamp OR simply time OR date.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...