topic Re: TIME_PREFIX in Getting Data In

TIME_PREFIX

shangshin — Wed, 30 May 2012 14:27:51 GMT

I have an autosys log with 4 columns (JobName|Start|End|Status) and would like to add them in splunk.

Check_Job|05/22/2012 02:09:17|05/22/2012 02:09:18|SUCCESS
Extract_Job|05/22/2012 03:09:17|05/22/2012 03:09:18|SUCCESS
Database_Job|05/22/2012 02:09:17||RUNNING

Two questions --

How can I set the primary event time to be end time (column 3)? Can I use TIME_PREFIX=\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2}
Is it possible to set a secondary event time?

Re: TIME_PREFIX

sdaniels — Mon, 28 Sep 2020 11:53:04 GMT

This link has an example that I included on your previous question. Splunk will only use one timestamp to represent the event time.

http://docs.splunk.com/Documentation/Splunk/latest/Data/Configurepositionaltimestampextraction

Once you get the regex ok for the TIME_PREFIX you will also need to set MAX_TIMESTAMP_LOOKAHEAD. In this case i think set it to 50.

Re: TIME_PREFIX

shangshin — Wed, 30 May 2012 14:53:41 GMT

The string length of the first column, job name, is between 3 - 60 characters. How can I be sure splunk won't pick start time as the event time knowing the timestamp format of start and end time is identical?

Re: TIME_PREFIX

sdaniels — Wed, 30 May 2012 14:56:36 GMT

Yes, that makes it more challenging. I think this is what you were looking for...manipulating the second date field anyways and leaving the current time stamp as is.

http://splunk-base.splunk.com/answers/4249/searching-mulitple-time-fields-within-a-record

Re: TIME_PREFIX

shangshin — Wed, 30 May 2012 15:39:23 GMT

This is not a bad solution. Is it possible to use relative time for the function strptime? (e.g. -30m or -2h)
The reason I am asking this is because I need to set up an alert and using a specific time won't be feasible.

Re: TIME_PREFIX

shangshin — Mon, 28 Sep 2020 11:53:12 GMT

Let me rephrase. Is there any function like this?

index=gops STATUS=closed | eval close_date=strptime(CLOSE_DATE,"%m/%d/%y %H:%M") | where close_date>datediff (@now, -30m)

Re: TIME_PREFIX

shangshin — Wed, 30 May 2012 15:54:31 GMT

relative_time will do the magic. I am good. thanks!

Re: TIME_PREFIX

sdaniels — Wed, 30 May 2012 15:58:57 GMT

not sure if those will apply to anything other than the indexed _time for the event but i'm not sure exactly what you are referencing. You can caluculate the time now() in epoch time and do conversions i think...just not as elegant a solution. http://splunk-base.splunk.com/answers/117/how-do-i-get-the-current-time