topic Re: timestamp extraction from two places during index time within an event in Getting Data In

timestamp extraction from two places during index time within an event

ankithreddy777 — Tue, 29 Sep 2020 18:36:29 GMT

I have an event like

"abcabcabc....abc.........time:-2017-05-05T0*8:08:08.987........abcxyz...abcxyz.....date:-2017-05-03*......"

I need to assign timestamp to each event at index time only , where date should be extracted from date field above and time value should be extracted from timestamp field.

Is there any possibility.
If I need to use datatime_renamed.xml . May I know what changes to be made in file?

Re: timestamp extraction from two places during index time within an event

SuryaNittala — Tue, 29 Sep 2020 18:35:09 GMT

Can you paste the sample event. You can achieve this by configuring TIME_PREFIX and MAX_TIMESTAMP_LOOKAHEAD in props.conf

Re: timestamp extraction from two places during index time within an event

niketn — Tue, 20 Mar 2018 20:02:28 GMT

@ankithreddy777, if time:-2017-05-05T* prefixes the time which you want Splunk to pick and also the date that you want to avoid you can use TIME_PREFIX regex to skip this.

Try the following props.conf settings (where 57 is number for characters to look ahead in order to find date. Based on sample data it is ........abcxyz...abcxyz.....date:-. You can change 57 to a different number based on actual estimated number of characters.

TIME_PREFIX=time:-\d{4}-\d{2}-\d{2}T\d*
MAX_TIMESTAMP_LOOKAHEAD=57