topic Re: work with a non-conventional timestamps in Getting Data In

work with a non-conventional timestamps

bluecoder008 — Fri, 13 Jul 2012 19:03:04 GMT

Hi, I am working with some legacy logs that have spaces in timestamps, e.g.

2012-07-12 06:00:05: 9 -07:00
2012-07-12 06:00:06:259 -07:00
2012-07-12 06:01:05: 45 -07:00

is there a way for splunk to extract the timestamps as '2012-07-12 06:00:05: 9 -07:00' etc?

Thanks!

Re: work with a non-conventional timestamps

rgcurry — Fri, 13 Jul 2012 19:51:26 GMT

Try this:

\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}:\s*(\d+)\s-\d{2}:\d{2}

Re: work with a non-conventional timestamps

bluecoder008 — Fri, 13 Jul 2012 21:19:44 GMT

Hi, rgcurry,

Thanks, so i will put this into the regex ? (not the timestamp strftime format)

Thanks again!

Re: work with a non-conventional timestamps

bluecoder008 — Fri, 13 Jul 2012 22:24:20 GMT

hi, it doesnt work. also, dont we need slash \ in front of 'd' and 's' ?

Re: work with a non-conventional timestamps

rgcurry — Fri, 13 Jul 2012 22:48:31 GMT

Yes, the slashes are needed, I did not notice that they got dropped when I pasted in my code sample. Something I still goof up on now and again on this site. It should work with the slashes included, I tested it and it worked for me just fine.

Use this to create a field extraction. Test it first as follows:

sourcetype={your_sourcetype} | rex fields=_raw "(?P<eventDateTime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}:\s*(\d+))"

Then copy the code between the double-quote marks into the regex in Field Extractions to save it for your App.