topic Re: Logs with no timestamp incorrectly getting date from file name in Getting Data In

Logs with no timestamp incorrectly getting date from file name

gpullis — Mon, 25 Jul 2011 20:10:53 GMT

I have a sourcetype where Splunk is correctly getting the time stamp from the events, but the events don't contain a date.

Unfortunately the logs are named like:

rkj050508_d0373452.broomecounty.us.tracesql

Where 050508 is part of a username, and not a date. But, sure enough, Splunk thinks the events are from 2008-05-05.

Is there a way to get the date from index-time, but get the time from the timestamp?

Re: Logs with no timestamp incorrectly getting date from file name

jbsplunk — Mon, 28 Sep 2020 09:45:28 GMT

I would suggest using DATETIME_CONFIG = current in props.conf for the sourcetype the data is assigned. I think it has a decent chance at telling splunk to use the system current timestamp for the event. You can also try to specify a TIME_FORMAT, TIME_PREFIX, and MAX_TIMESTAMP_LOOKAHEAD in props.conf to tell splunk what the time format is, where to look for the timestamp, and how many characters the timestamp contains. If there isn't a date in the file, just don't specify one. The default behavior is that when the log doesn't contain a date, to revert to the mod time of the file for the date. Hopefully this will get you close to what you'd like to see.

http://www.splunk.com/base/Documentation/latest/Data/Configuretimestamprecognition

Re: Logs with no timestamp incorrectly getting date from file name

gpullis — Tue, 26 Jul 2011 13:54:11 GMT

Thanks, but what I'd like to do is use the timestamp from the log entry plus the modification date of the file to form the timestamp for the event. Is there a way to do that?

Re: Logs with no timestamp incorrectly getting date from file name

jbsplunk — Tue, 26 Jul 2011 18:49:31 GMT

I edited my answer to reflect what I would suggest given this information.

Re: Logs with no timestamp incorrectly getting date from file name

gpullis — Sun, 07 Aug 2011 00:53:49 GMT

Actually, the default behavior appears to be to look for a date in the filename if it can't find a date in the event.