topic timestamp recognition in multi timestamp event in Getting Data In

timestamp recognition in multi timestamp event

lukasz92 — Mon, 28 Sep 2020 18:40:45 GMT

Hi all!

I have a problem with my log. Some events have only one timestamp, some have two - as in this example : http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Configurepositionaltimestampextraction#Example

How should I configure splunk to always match the latest timestamp in the event?
I could write regex, but I only can provide time PREFIX (TIME_PREFIX=...). If I write a TIME_PREFIX for two-timestamps-event - some events (with only one timestamp) will have incorrect time (time of indexing)

Re: timestamp recognition in multi timestamp event

FritzWittwer_ol — Mon, 12 Jan 2015 14:15:03 GMT

I would try it with a regexp with a two alternatives, one with a positive look ahead (?=…second time stamp regexp…)so it only matches if there is a second timestamp, did not try it out, but I think this could work.

Re: timestamp recognition in multi timestamp event

somesoni2 — Mon, 12 Jan 2015 15:39:01 GMT

Can you provide some samples of your events (mask sensitive information) with both single and double timestamp values.?

Re: timestamp recognition in multi timestamp event

lukasz92 — Fri, 06 Feb 2015 14:55:54 GMT

I solved my problem with using one, more complicated regex - with question mark match: ()?
TIME_PREFIX = (.*something123 (\[)?([^,]*, somethingother[^,]*,[^,]*, [^0-9]*)?)?
It was possible with my custom data.

@FritzWittwer
I haven't tried your solution, maybe it works.

I will keep the question open, for other ideas.