Include or clean incorrect timestamps

atown100 — Wed, 13 May 2015 15:08:29 GMT

I have an application log that primarily has timestamps like the following:-

(14.2) 05-12-15 14:28:14 (.....

However sometimes, for certain events, the application misses off the last digit and we get this:-

(14.2) 05-12-15 14:28:1 (....

Obviously, Splunk splits up my events correctly when the timestamp is correct but merges events when the timestamp is wrong.

Is there any way to either;
a) exclude the text lines from the logs where the timestamp is wrong (we can probably live with this) before indexing, or
b) make Splunk use the incorrect timestamps as well, maybe appending a zero (0) onto them

Thanks for any assistance.
b/

Re: Include or clean incorrect timestamps

woodcock — Thu, 14 May 2015 18:23:09 GMT

Make this a Heavy Forwarder and repair the events before they are indexed:
http://docs.splunk.com/Documentation/Splunk/5.0.4/Data/Anonymizedatausingconfigurationfiles#Through_a_sed_script

Your entry should look like this:

[&lt;spec&gt;]
SEDCMD-FixTimestmapBeforeIndexing = s/\(:[0-9]\) /\10 /

topic Include or clean incorrect timestamps in Getting Data In

Include or clean incorrect timestamps

Re: Include or clean incorrect timestamps