topic Re: Need assistance in setting a sourcetype--date/time in Getting Data In

Need assistance in setting a sourcetype--date/time

NanSplk01 — Mon, 29 Jul 2024 18:59:22 GMT

I am trying to create a sourcetype for a new client:

Note StartDate=xxxx is where the log begins. However the StartTime=*** is not with it, but I need both int he logs. How do I create this sourcetype?

C:\Program Files\Universal\UAGSrv\xxx>set StartDate=Mon 07/29/2024

C:\Program Files\Universal\UAGSrv\xxx>set sdy=2024

C:\Program Files\Universal\UAGSrv\xxx>set sdm=07

C:\Program Files\Universal\UAGSrv\xxx>set sdd=29

C:\Program Files\Universal\UAGSrv\xxx>set sdy=2024

C:\Program Files\Universal\UAGSrv\xxx>set sdm=07

C:\Program Files\Universal\UAGSrv\xxx>set sdd=29

C:\Program Files\Universal\UAGSrv\xxx>set StartTime=14:45:09.56

any assistance would be very helpful and appreciated.

Re: Need assistance in setting a sourcetype--date/time

richgalloway — Mon, 29 Jul 2024 19:20:49 GMT

Wow. The developer that created that log needs to be taught how to use Splunk so he can see how awful his creation is.

Is that one event or several? Or is that the prologue to the log file?

You may be able to use a custom datetime.xml file or you may want to consider an input script that normalizes the timestamp.

Re: Need assistance in setting a sourcetype--date/time

NanSplk01 — Mon, 29 Jul 2024 19:33:13 GMT

It is one of several blocks of lines inside the log file. Each starts with the little snippet I put above and then has any number of lines after it. While the file is a .txt, the look to me would be a xml document that pushes out the log file. I've not seen one like it before. I was thinking I'd need a props or transform or both to set this date/time, but it's my first experience with it.

Re: Need assistance in setting a sourcetype--date/time

richgalloway — Tue, 30 Jul 2024 12:30:21 GMT

While every sourcetype should have props defined, this may be beyond what transforms can do. Timestamp extraction happens before transforms are applied, which is why I suggested an input script do the work.

Re: Need assistance in setting a sourcetype--date/time

NanSplk01 — Tue, 30 Jul 2024 16:11:10 GMT

Well, I did find another line which has the date and time, but it's over 15 lines into the log file. We need to start with the first line which is the beginning of the stanza, but get the timestamp which is 15th line showing after the opening line shown below

C:\Program Files\Universal\UAGSrv\xxxl_p01.nam>set StartDate=Tue 07/23/2024

This is the actual timestamp which I think would work since it has both date and time (hoping that's what the _80514 is the time??

Files\Universal\UAGSrv\xxx_p01.nam>set timestamp=20240723_80514

Re: Need assistance in setting a sourcetype--date/time

richgalloway — Wed, 31 Jul 2024 00:11:20 GMT

You probably could define TIME_PREFIX to find that timestamp. However, is the timestamp present for every event or just once in the file? If the latter, then start writing code to re-process that file into something Splunk can ingest more easily.