topic Re: Recognizing timestamps split across multiple lines in Getting Data In

Recognizing timestamps split across multiple lines

MatMeredith — Tue, 30 Apr 2013 08:22:44 GMT

My event have separate date and time fields on separate lines. E.g.

Date: 29 April 2013

Time: 12:02:03.6

Is it possible to configure Splunk to automatically extract timestamps for these events, piecing together the date and time as necessary?

Many thanks!

Re: Recognizing timestamps split across multiple lines

kristian_kolb — Mon, 28 Sep 2020 13:48:24 GMT

Splunk is fairly good at interpreting timestamps by itself. You could try to index a log file and see how well it performs. Two things, though;

1) ensure that you have correct line_breaking, since splunk will normally break events when on the line where it encounters a timestamp. So if you have some lines before the timestamp that are part of the event, you may need to get explicit with some props.conf settings (either a SHOULD_LINEMERGE=true / MUST_BREAK.., BREAK_ONLY.. combo, or SHOULD_LINEMERGE=false / LINE_BREAKER combo. See the docs for props.conf for this.

2) You'll probably need to adjust the MAX_TIMESTAMP_LOOKAHEAD to a higher number than the default 150.

See this (and the following) page(s);

http://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps

Hope this helps,

Kristian

Re: Recognizing timestamps split across multiple lines

_d_ — Tue, 30 Apr 2013 19:08:11 GMT

Not automatically. I would use datetime.xml here and define custom extractions.

Re: Recognizing timestamps split across multiple lines

MatMeredith — Wed, 01 May 2013 08:46:29 GMT

Sadly this doesn't seem to work. Splunk cannot automatically figure out the separate date and time fields... Thanks though!

Re: Recognizing timestamps split across multiple lines

MatMeredith — Wed, 01 May 2013 08:47:21 GMT

That's what I feared... Thanks!