https://community.splunk.com/t5/Getting-Data-In/timestamp-date-in-header-time-in-every-event/m-p/433034#M75713 <P>Hi,<BR /> I have a log that the date part of the timestamp for every event only comes in the header and footer. I am able to parse the header, but that gives the same timestamp to every event. <BR /> Using a time_prefix: ([^,]+,){4} and the regex %H%M%S%2N to parse the last value as the time, it sometimes says that it is unable to parse it to a strptime and other times it parses it ok, even using the date of the header.</P> <P>Log sample:</P> <P>20181214,092255<BR /><BR /> 9688,P088,I,01001,09441963<BR /><BR /> 9688,P088,O,01001,09441984<BR /><BR /> 9689,P088,I,01001,09442063<BR /><BR /> 9689,P088,O,01001,09442077<BR /><BR /> 9706,P015,I,05001,09442099<BR /><BR /> 20181214,175510 </P> <P>Any help in ensuring a proper timestamp parsing in every occasion will be highly appreciated.</P> Fri, 26 Apr 2019 21:42:20 GMT evidales 2019-04-26T21:42:20Z https://community.splunk.com/t5/Getting-Data-In/timestamp-date-in-header-time-in-every-event/m-p/433034#M75713 <P>Hi,<BR /> I have a log that the date part of the timestamp for every event only comes in the header and footer. I am able to parse the header, but that gives the same timestamp to every event. <BR /> Using a time_prefix: ([^,]+,){4} and the regex %H%M%S%2N to parse the last value as the time, it sometimes says that it is unable to parse it to a strptime and other times it parses it ok, even using the date of the header.</P> <P>Log sample:</P> <P>20181214,092255<BR /><BR /> 9688,P088,I,01001,09441963<BR /><BR /> 9688,P088,O,01001,09441984<BR /><BR /> 9689,P088,I,01001,09442063<BR /><BR /> 9689,P088,O,01001,09442077<BR /><BR /> 9706,P015,I,05001,09442099<BR /><BR /> 20181214,175510 </P> <P>Any help in ensuring a proper timestamp parsing in every occasion will be highly appreciated.</P> Fri, 26 Apr 2019 21:42:20 GMT https://community.splunk.com/t5/Getting-Data-In/timestamp-date-in-header-time-in-every-event/m-p/433034#M75713 evidales 2019-04-26T21:42:20Z