topic Re: Tricky parsing requirement in Getting Data In

Tricky parsing requirement

ssledzie — Wed, 19 Feb 2014 23:39:34 GMT

Say I fed a file into splunk that had a date field at the top.

Then after that, one event per line that contained a time offset from the aforementioned date field. Any way I could make splunk assign a timestamp from date+time offset to the event?

Re: Tricky parsing requirement

lukejadamec — Thu, 20 Feb 2014 00:01:14 GMT

I'm gonna venture an educated guess - No, you cannot perform math on index time extractions.

However, you can math in a search. Once you get it the way you want it, you can create a macro so it can be called easily.

Re: Tricky parsing requirement

ssledzie — Mon, 24 Feb 2014 18:55:52 GMT

What if I didn't do any math but appended the start date to every event? Is that possible?

Re: Tricky parsing requirement

Ayn — Mon, 24 Feb 2014 19:15:07 GMT

You'd still have to do math in order to add the start date and the offset. The timestamp processor doesn't have that kind of functionality.

Re: Tricky parsing requirement

ssledzie — Mon, 24 Feb 2014 19:51:34 GMT

That's fine. I'm willing to do that calculation at search time. But I still need the all the data on the event to do that.

Re: Tricky parsing requirement

lukejadamec — Mon, 24 Feb 2014 19:57:15 GMT

Have you read this doc? http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/HowSplunkextractstimestamps
According to that doc, if you can configure props.conf to recognize the 'date field' as an event of the same sourcetype, and pull the date as a date time, then all subsequent events would default to that 'date time' because the subsequent events of that same sourcetype do not have a valid 'date time'.

It is tough without seeing the data or log file structure.

Re: Tricky parsing requirement

ssledzie — Mon, 24 Feb 2014 20:39:41 GMT

I'll check the doc thanks. In either case, the format would be something like:

DATE: 02/24/2014 11:00:00

0
5
10

In the above example 0,5, and 10 are offsets from the date header.