Time field needs to be forced to appear at beginning of event about azurefunctionforsplunkvs HOT 5 CLOSED

@jijulukose Apologies for the delay getting to this. I'll take a look.
Can you give me a before/after example? Are you asking that each new message be refactored to move the time field?

from azurefunctionforsplunkvs.

Any word on this?

from azurefunctionforsplunkvs.

from azurefunctionforsplunkvs.

This isn't as easy as you might think. The messages come from many different resources and each has its own format. On top of that, new resources emit into the same event hub as they come online. This means that I can't write a dotnet object for each of them to de-serialize into, placing "time" at the beginning.
Does it matter the name of the time property? I can add an extra time field and put it up front. Or - maybe better - I can add "time" to the event metadata - as mentioned on this page: http://dev.splunk.com/view/event-collector/SP-CAAAE6P

from azurefunctionforsplunkvs.

I added time to the splunk event metadata. The time of the event is extracted from the message itself and converted to epoch according to HEC metadata definition. This is in the master branch.

from azurefunctionforsplunkvs.