topic Timestamp within event in Getting Data In

Timestamp within event

splunklearner12 — Fri, 24 May 2019 15:23:23 GMT

My log file contains events that sometimes contain timestamp strings of other actions.
For example, an event may have occurred at 24/05/19 07:58:12.000, but the event itself contains references to when a certain action was last conducted such as "last update on 5/20/2019 12:45:09.000." .
Is it possible to still interpret those values as time values so one could for example create a graph showing all historical updates?

Re: Timestamp within event

richgalloway — Fri, 24 May 2019 16:48:14 GMT

Yes, it's possible. First extract the string into a field then use strptime to convert it into a timestamp in epoch form. For example:

... | rex "last update on (?<lastUpdateStr>\S+\s\S+)" | eval lastUpdateTime=strptime(lastUpdateStr, "%m/%d/%Y %H:%M:%S.%3N") | ...

Re: Timestamp within event

splunklearner12 — Mon, 27 May 2019 08:07:39 GMT

Excellent, thank you.

Re: Timestamp within event

richgalloway — Tue, 28 May 2019 12:32:44 GMT

@splunklearner1234 If your problem is resolved, please accept the answer to help future readers.

Re: Timestamp within event

splunklearner12 — Tue, 28 May 2019 12:36:19 GMT

sorry I though clicking the ^ did that.