Datetime.xml - extracting hour that does not exist

twkan — Thu, 04 Apr 2013 12:51:04 GMT

Hello all,

I have a series of logs that looks like this:

200312,111523  -> this means 20 March 2012, 11:15:23 am
200312,53344  -> this means 20 March 2012, 05:33:44 am (note that the first 0 is missing in the hour)
200312,1428 -> this means 20 March 2012, 00:14:28 am (note that the first two 00 are missing in the hour)

I have already written the datetime.xml to cater for the first two scenarios. But for the 3rd one where the hour is totally missing, how do I cater for this on my datetime.xml?

Has anyone managed to think of a way to 'substitue' 00 as the hour if it's missing from the logs itself?

Thanks for any insights.

Re: Datetime.xml - extracting hour that does not exist

twkan — Fri, 05 Apr 2013 00:12:40 GMT

Okay, decided to write a script to pad the time with zeros before being indexed by Splunk.

topic Datetime.xml - extracting hour that does not exist in Getting Data In

Datetime.xml - extracting hour that does not exist

Re: Datetime.xml - extracting hour that does not exist