Getting Data In

TIMESTAMP_FIELDS for different sources and timestamps using same sourcetype _json

splunkreal
Motivator

Hello guys,

TIMESTAMP_FIELDS must be setup in props.conf on indexers side, therefore how to use TIMESTAMP_FIELDS for different sources and timestamps using same sourcetype _json? Must we define sub-sourcetypes? Is it possible and how?

First source :

[_json]
TIMESTAMP_FIELDS = @timestamp
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z

Second source :

[_json]
TIMESTAMP_FIELDS = @start
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z

Thanks.

* If this helps, please upvote or accept solution 🙂 *
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

When you start splunk, splunk merges all stanza and parameters from same type of configuration file defined in various apps and system/default & system/local . When you define same parameter for same sourcetype in same configuration file (Here in your case props.conf) then precedence order will come into picture. Have a look at https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Wheretofindtheconfigurationfiles

The way you want to achieve might not possible using sourcetype but if you have different source for both the data then you can use below configuration

props.conf

[source::yourSource1]
TIMESTAMP_FIELDS = @timestamp
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z

[source::yourSource2]
TIMESTAMP_FIELDS = @start
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z 

OR you can try below config, if you want to use sourcetype but I'll not suggest to modify default sourcetype which ships with Splunk installation. Best practice is to create your own sourcetype.

props.conf

[yourSourcetype]
TIMESTAMP_FIELDS = @timestamp,@start
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z

View solution in original post

splunkreal
Motivator

This works, thanks :

UF

props.conf
[metrics_json]
TIMESTAMP_FIELDS = start
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z
INDEXED_EXTRACTIONS = json

inputs.conf
[monitor:///VAR/logs/metrics.log]
blacklist = archives
disabled = false
index = ppr_app
sourcetype = metrics_json


IDX

props.conf

[metrics_json]
TIMESTAMP_FIELDS = start
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z


SH

props.conf
[metrics_json]
KV_MODE = json

* If this helps, please upvote or accept solution 🙂 *
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

When you start splunk, splunk merges all stanza and parameters from same type of configuration file defined in various apps and system/default & system/local . When you define same parameter for same sourcetype in same configuration file (Here in your case props.conf) then precedence order will come into picture. Have a look at https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Wheretofindtheconfigurationfiles

The way you want to achieve might not possible using sourcetype but if you have different source for both the data then you can use below configuration

props.conf

[source::yourSource1]
TIMESTAMP_FIELDS = @timestamp
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z

[source::yourSource2]
TIMESTAMP_FIELDS = @start
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z 

OR you can try below config, if you want to use sourcetype but I'll not suggest to modify default sourcetype which ships with Splunk installation. Best practice is to create your own sourcetype.

props.conf

[yourSourcetype]
TIMESTAMP_FIELDS = @timestamp,@start
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N.%z
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...