topic Re: Extract Timestamp from logs that don't contain any Year reference in Getting Data In

Extract Timestamp from logs that don't contain any Year reference

lmeur — Thu, 24 Mar 2011 20:33:55 GMT

I need to extract a timestamp from log files looking like that :

Feb 16 23:58:44 ...

As you can see, there is no reference to the year when the log was generated, so what I want to do is to extract day, month and hour reference and then mix it with current year from the splunk instance (or from the file last modification date).

Do you see a simple way to do this ?

Ludovic.

Re: Extract Timestamp from logs that don't contain any Year reference

Ant1D — Thu, 24 Mar 2011 21:48:59 GMT

Hi,

When you run a search on these logs in your Splunk instance, you will see fields on the left-hand side that you can pick from. Select the last option that says All (number) fields. There should be a field named date_year that you can use.

Re: Extract Timestamp from logs that don't contain any Year reference

lmeur — Mon, 28 Sep 2020 09:26:47 GMT

date_year allow me to get date field on search results but what I'm looking for is to change year on date_year field before indexing logs (during logs fields extraction)

Re: Extract Timestamp from logs that don't contain any Year reference

Ant1D — Tue, 29 Mar 2011 17:05:42 GMT

My understanding is that you can either: Clean your index, edit the timestamps in the logs manually to include the year and then have these logs indexed in order to see the year in the timestamp as the value for the date_year field OR if this is not efficient then maybe you can achieve this in props.conf via a field extraction