topic How to configure Splunk to recognize the timestamp format in my data where the Date and Time are not in the same line? in Getting Data In

How to configure Splunk to recognize the timestamp format in my data where the Date and Time are not in the same line?

voshka — Thu, 16 Jun 2016 08:52:40 GMT

Hello,

I have a problem when I want to extract the timestamp from an event in adding data to Splunk.

Here is a sample event :

<LOG>
  <DATE>12022012</DATE>
  <TIME>004459</TIME>
  <EventID>131</EventID>
  <Version>0</Version>
  <Level>4</Level>
  <Task>33</Task>
  <Opcode>0</Opcode>
  <Keywords>0x8000000000000004</Keywords>
  <EventRecordID>7150639</EventRecordID>
  <Correlation />
</LOG>

I matched the timestamp prefix with this regex: \s*(?=\d{8}<\/DATE>\s*\d{6})
But I have a problem with the timestamp format because the Date and Time are not in the same line.

However, if the Date and Time were in the same line, Splunk can recognize the timestamp with this configuration:
Timestamp prefix : \s*(?=\d{8}<\/DATE>\s*\d{6})
Timestamp format : %d%m%Y%H%M%S

I really appreciate any help you can provide.

Re: How to configure Splunk to recognize the timestamp format in my data where the Date and Time are not in the same line?

voshka — Thu, 16 Jun 2016 13:58:31 GMT

I think Splunk can only match the timestamp when the Date and Time were in the same line while on this event the date and time are in two different line,
How can i recognize the timestamp on this event log.

Regards

Re: How to configure Splunk to recognize the timestamp format in my data where the Date and Time are not in the same line?

muebel — Thu, 16 Jun 2016 15:07:53 GMT

Hi voshka, This looks similar to another question here, the answer of which I believe you could adapt towards your needs : https://answers.splunk.com/answers/406376/how-do-i-edit-my-datetimexml-file-for-my-custom-da.html

Please let me know if this works out for you!

Re: How to configure Splunk to recognize the timestamp format in my data where the Date and Time are not in the same line?

gagi76 — Tue, 05 Jul 2016 12:50:21 GMT

I have the same problem like Voshka. The link above is for logs that are in one line. I have almost the same log as Voshka and don't know how to get those date and time to be recognize?

Any ideas?