Getting Data In

Overwrite timestamp with two variables

pwjones89
Engager

I am attempting to overwrite the timestamp Splunk has assigned to each event, with a field which holds an events month, and another with its year. A modification to props.conf would be preferable compared to an inline change, as I would like to call earliest=@mon etc which I believe cannot be done with a _time=......

Thanks.

1 Solution

bmacias84
Champion

Splunk areadly does that for you.

Splunk has the following data time fields:

  • date
  • date_hour
  • date_mday
  • date_minute
  • date_month
  • date_second
  • date_wday
  • date_year
  • date_zone

Additional Reading:
Aboutdefaultfields

Hope this helps or gets you started. Dont forget to accept and vote up answers that help.

View solution in original post

pwjones89
Engager

There was an internal timestamp which was being used to overwrite _time, however that timestamp has been dropped in favour of aggregating events on a monthly basis. Hence why I am looking to base _time on the month and year fields within the data.
Currently I have modified the props.conf to include TIME_PREFIX and TIME_FORMAT options.
I will return will its success.

0 Karma

kristian_kolb
Ultra Champion

You should probably post a few sample events, and describe which part you want to change. Are you sure that this isn't more about getting Splunk to understand (better) the timestamp(s) already inside the event.

0 Karma

bmacias84
Champion

Splunk areadly does that for you.

Splunk has the following data time fields:

  • date
  • date_hour
  • date_mday
  • date_minute
  • date_month
  • date_second
  • date_wday
  • date_year
  • date_zone

Additional Reading:
Aboutdefaultfields

Hope this helps or gets you started. Dont forget to accept and vote up answers that help.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...