topic Re: Add new custom timestamp in Getting Data In

Add new custom timestamp

Eagleman — Fri, 29 Oct 2010 21:05:16 GMT

Hello

I have a timestamp like Oct28-215189[ERROR]remoteHost: something

I tried to train splunk to recognize it but without luck.

could you give me some help ?

Thanks.

Re: Add new custom timestamp

dwaddle — Fri, 29 Oct 2010 21:58:20 GMT

Some more information would be necessary to help with this. I assumed at first that this was "MonDD-HHMMSS" -- but 89 seconds did not make sense. In that example above, what date/time does it actually represent?

Re: Add new custom timestamp

Eagleman — Fri, 29 Oct 2010 22:03:29 GMT

Ups. you are right. 89 is a type. actually it is
Oct28-215129[ERROR]remoteHost: something

as you guess, it represents "MonDD-HHMMSS"

Re: Add new custom timestamp

Eagleman — Fri, 29 Oct 2010 22:04:24 GMT

a typo in the typo. where i say "type" i mean typo

Re: Add new custom timestamp

dwaddle — Fri, 29 Oct 2010 22:14:40 GMT

You can configure Splunk to parse a time field specifically using props.conf

http://www.splunk.com/base/Documentation/latest/Admin/Propsconf

This is the first option Splunk uses to parse a time, according to http://www.splunk.com/base/Documentation/latest/Admin/Configuretimestamprecognition

The TIME_FORMAT and TIME_PREFIX options in props.conf are going to be most useful here.

[my_sourcetype]
TIME_PREFIX=^
TIME_FORMAT=%b%d-%H%M%S

That should properly parse your time stamp. The only part I'm unsure about is where it will get the year from. It might be worth some testing if you can dummy up a system time to fake the year rollover.

Re: Add new custom timestamp

Eagleman — Fri, 29 Oct 2010 22:22:11 GMT

Thanks 😛 I did the same but propably it didn't work because i forgot the "^". Something more. Is there any way to extract the host ? (it's right after [ERROR]

Re: Add new custom timestamp

dwaddle — Tue, 02 Nov 2010 02:39:03 GMT

yes, you should be able to extract the host using a regex ... docs cover it here - http://www.splunk.com/base/Documentation/latest/Admin/Overridedefaulthostassignments .. if this doesn't get you going, I recommend you submit a new question specific to that. (Trying to handle follow-ons in comments can get difficult)