topic Re: How do I configure timestamp extraction where day may be one or two digits in Getting Data In

How do I configure timestamp extraction where day may be one or two digits

clmiller — Mon, 28 Sep 2020 10:12:48 GMT

I have a timestamp of form
[10/15/11 11:55:08:992 PDT] . . . log entry text . . .

I expect I can try the following specifier in props.conf file for the above Oct 10th 2011 date format:
TIME_PREFIX = ^.
MAX_TIMESTAMP_LOOKAHEAD = 22
TIME_FORMAT = %y/%d/%m %k:%M:%S
But for dates where the day of the month of log entry is less than 10 I hve something like:
[12/8/11 11:55:08:992 PDT] . . . log entry text . . .
My understanding is %d works for a two digit day format, but I don't see a good option when day can be two digits or a single non-padded digit day of month representation.
Suggestions?

Re: How do I configure timestamp extraction where day may be one or two digits

kristian_kolb — Thu, 15 Dec 2011 11:44:53 GMT

Hi, not that I've tried it, but %e might work for you.

According to http://www.tutorialspoint.com/python/time_strftime.htm

%d - day of the month (01 to 31)
%e - day of the month (1 to 31)

Hope this helps,

Kristian

Re: How do I configure timestamp extraction where day may be one or two digits

clmiller — Mon, 28 Sep 2020 10:13:45 GMT

I believe unfortunately that the "%e" opption still winds up with two characters.
Though lot of python tutorials do not mention it, when the day number is less than 10
"%e" seems to front pad with a blank, where "%d" frontpads with a zero.
As is born out by the folowing ksh and python script content and output.

#----------------------

#!/bin/ksh

# ksh_date_with_d_and_e

# If current day of the month is greater than 9 then print date time out

# for the 9th of the month. Otherwise print out current date time

#

DAY=date +%e

if [ $DAY -gt 9 ]

then

let BACK=$DAY-9

else

BACK=0

fi

date -d "$BACK days ago" +"%y/%d/%m %k:%M:%S"

date -d "$BACK days ago" +"%y/%e/%m %k:%M:%S"

# END

SAMPLE OUTPUT:

11/09/12 10:50:15

11/ 9/12 10:50:15

#----------------------

#!/usr/bin/python

# python_date_with_d_and_e"

# Using hard coded date here

#

import time

t = (2011, 12, 9, 17, 3, 38, 1, 48, 0)

t = time.mktime(t)

print time.strftime("%y/%d/%m %k:%M:%S", time.gmtime(t))

print time.strftime("%y/%e/%m %k:%M:%S", time.gmtime(t))

# END

SAMPLE OUTPUT:

11/09/12 23:03:38

11/ 9/12 23:03:38

#----------------------

Unless splunk does something special for "%e" different than python or ksh,

it seems this would still not match for a single character day in date field

I have not had a chance to experiment further so is still conjecture on my part.

Re: How do I configure timestamp extraction where day may be one or two digits

FRoth — Mon, 18 Aug 2014 15:31:20 GMT

Yes - it does not do what it is supposed to do. I want to extract the day from "Aug 18 17:11:16" and "Aug 8 17:11:16". %e is not white space padded.