topic Timestamp extraction issue in Splunk Search

Timestamp extraction issue

asarolkar — Mon, 04 Mar 2013 19:49:19 GMT

Hi everyone,

I have the following log line which has two timestamps and we need to get the SECOND one.

Mar  4 18:50:02 ids1-ecojbs-p01 access_combined: 10.142.1.109 - - [04/Mar/2013:10:50:03 -0800]

I tried using the wizard that Splunk provides and changed the setting in
Manager » Data inputs » Add data » A file or directory of files » Files & directories » Data preview, to the following

NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true
TIME_FORMAT=/[%d/%b/%Y:%H:%M%S]/g

But this regex does not seem to be working out

Other potential log lines (where the second timestamp needs to be extracted), look like

Mar  4 18:50:02 ids1-ecojbs-p01 syslog: 10.142.1.109 - - [04/Mar/2013:10:50:03 -0800]
Mar  4 18:50:02 ids1-ecojbs-p01 oslog: 10.142.1.109 - - [04/Mar/2013:10:50:03 -0800]

Does anybody know what else ought to be configured in the wizard ?
Does it need a TIME_PREFIX ?
All input (especially by those who know regex) is welcome !

Re: Timestamp extraction issue

Ayn — Mon, 04 Mar 2013 20:20:12 GMT

Not sure what the leading / and trailing /g in your TIME_FORMAT is meant to be? It seems a bit like sed syntax...

The easiest thing would be to pick a TIME_PREFIX that makes Splunk jump to the correct timestamp. From there on I'm fairly sure it will recognize the timestamp format itself. Perhaps

TIME_PREFIX = - - \[

Re: Timestamp extraction issue

asarolkar — Tue, 05 Mar 2013 01:56:56 GMT

That partly solved the problem.

I will pose my question once again (this time with more detail)