topic Re: Timestamp separeted by many field/character in Getting Data In

Timestamp separeted by many field/character

emaccaferri — Tue, 16 Jul 2013 09:20:12 GMT

Hi!
I'm trying to extract a timestamp from a log like

"0123456" "01/02/2000" "XxXxXx" "YyYyY" "ZzZzZ" "1" "12:00"

(letters' number is undefined)

By default Splunk recognize all "01/02/2000" "XxXxXx" "YyYyY" "ZzZzZ" "1" "12:00" as a timestamp.

I tried to use %d/%m/%Y\D+\d"%H:%M inside the manager but it doesn't work.
Any idea?

grijhwani — Tue, 16 Jul 2013 16:55:18 GMT

So are you trying to say that - from your example data - you would want to extract the final value "01/02/2000 12:00"?

grijhwani — Tue, 16 Jul 2013 17:15:00 GMT

This should be along the lines you want, if I understand the question correctly:

{search} | rex "(?<fdate>\d{2}/\d{2}/\d{4}).*(?<ftime>\d{2}:\d{2})" | eval dateandtime=fdate." ".ftime | table dateandtime

bmacias84 — Mon, 28 Sep 2020 14:21:40 GMT

what does your props.conf file for the sourcetype look like? MAX_TIMESTAMP_LOOKHEAD is 150 char, but you event doesnt pass that limit.

bmacias84 — Tue, 16 Jul 2013 17:29:13 GMT

Another ideas would be to would be to overide the MetaData using a transform. How familar are you with transforms.