topic Re: How to extract unusual time information? in Getting Data In

How to extract unusual time information?

peterschloenske — Mon, 03 Feb 2020 17:47:08 GMT

Hello,

I have events without a timestamp like epochtime or a format like 2020-02-03 18:41:00.
The needed information is kind of split up in the raw event. Raw events look like this sample:

sometext, date,20200203, some text, some text, time,184100, some text

Is it possible to create a useful timestamp extraction of out this during the data onboarding?

Best regards

Re: How to extract unusual time information?

PavelP — Mon, 03 Feb 2020 19:50:31 GMT

you have to use custom datetime config which allows regexes between date and time:
https://www.function1.com/2013/01/oh-no-splunking-log-files-with-multiple-formats-no-problem

Re: How to extract unusual time information?

13tsavage — Mon, 03 Feb 2020 19:50:58 GMT

Are these coming from the same source or from different sources heading to the same index?

Re: How to extract unusual time information?

PavelP — Mon, 03 Feb 2020 20:50:57 GMT

if I understand it correctly the date and the time are in the same log event, which implies it comes from the same source

Re: How to extract unusual time information?

13tsavage — Tue, 04 Feb 2020 14:33:53 GMT

Okay then you need to figure out which format the date and timestamp mark the beginning of a new event. Then you can create custom event breakers for that specific data source.

Figure out which time stamp is shown in EVERY event that marks the beginning of that event, and I can help you with the rest.