input for splunk

achille83 — Sat, 16 May 2020 19:28:29 GMT

Hi,
I should monitor a log file in a Splunk all-in-one windows-based.
This file contains a sequence of rows with a time in the format HH:MM:SS and in the file name there is the date (DD-MM-YYYY).
How can I associate the right timestamp to the events taking the date from filename and the time from the rows contained in the file?
Thanks to everyone for the support.

Re: input for splunk

PavelP — Wed, 30 Sep 2020 05:25:50 GMT

Hello @achille83

is the log file modification time/date corresponds with the file name? For example are the events in the 16-05-2020.log being written on 16-05-2020 or later? This is a pretty common scenario and splunk is able to handle it: https://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps

If no events in a source have a date, Splunk software tries to find a date in the source name or file name.

So your option is to configure a correct TIME_FORMAT and TIME_PREFIX and let splunk to extract data from the source file name.

I've just tested and it works for log named 2020-04-10.log (events have data 10 Apr 2020) but not for 10-04-2020.log so you may need to adjust your software to create logs with a right file name to "help" splunk.

If all this doesn't work, you can create a custom datetime.xml file, here is an example https://www.splunk.com/en_us/blog/tips-and-tricks/configure-splunk-to-pull-a-date-out-of-a-non-standard-filename.html

topic input for splunk in Getting Data In

input for splunk

Re: input for splunk