The PowerConnect Cloud agent can be configured to extract timestamps from the source events. By default the Inputs assign the _time field in Splunk to the timestamp when the event was collected. This behaviour can be modified so an Input assigns the _time field to a timestamp from the source event instead.

Note - currently in version 1.0.8 only the CPI message input supports timestamp extract but others will be supported in the next version 1.0.9.

Configuring a Timestamp for an Input

  • Whilst creating an Input or editing an existing Input click on the Timestamp tab

  • In the Timestamp Field dropdown choose a field from the event to use as the _time field in Splunk. Only fields mapped as Date/Timestamps will be shown

  • Click Save